A critical code injection vulnerability in the VillaTheme Cart All In One For WooCommerce plugin allows authenticated administrators to execute arbitrary PHP code on the server.

The vulnerability exists due to insufficient input validation on the Assign page field, which is passed directly to an eval function. This flaw allows an authenticated attacker with Administrator-level privileges to perform remote code execution on the host server.

The ability to execute arbitrary PHP code on a web server represents a total compromise of the application environment. With a CVSS score of 7.2, this vulnerability poses a high risk as it grants an attacker full control over the WordPress instance, potentially leading to unauthorized data access, modification of site content, or lateral movement within the network.

Immediate Action: Update the Cart All In One For WooCommerce plugin to the latest available version beyond 1.1.21 immediately.

Proactive Monitoring: Audit WordPress administrative logs for suspicious modifications to plugin settings or unauthorized file changes within the plugin directory.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block suspicious input patterns targeting administrative endpoints and eval-related functions.

Public Exploit Available: No (exploit_available: unknown)

Given the severity of potential remote code execution, organizations using this plugin must prioritize the update process. Administrators should verify the plugin version and apply the patch as soon as possible to neutralize this critical injection risk.