The FunnelFormsPro plugin for WordPress is susceptible to a critical code injection vulnerability, permitting authenticated attackers to execute arbitrary code on the underlying server.

This is a Code Injection (CWE-94) vulnerability. The plugin fails to properly sanitize inputs, allowing an attacker with low-level privileges to inject and execute arbitrary code on the server.

Successful exploitation grants an attacker full control over the web server, leading to potential data exfiltration, total system compromise, and the ability to pivot into the internal network. With a CVSS score of 9.9, this vulnerability represents a critical risk to any organization hosting this plugin, as it facilitates full administrative control via remote code execution.

Immediate Action: Immediately deactivate and remove the FunnelFormsPro plugin from the production environment until a security patch is released by the vendor.

Proactive Monitoring: Review web server logs for suspicious file modifications, unusual PHP execution patterns, or unauthorized access to sensitive system files.

Compensating Controls: Ensure the web server process runs with the least privilege necessary and utilize a WAF with rules configured to detect and block common code injection payloads.

Public Exploit Available: No

Due to the critical nature of this RCE vulnerability and the lack of a verified patch, the most effective remediation is the complete removal of the vulnerable plugin. Security teams should audit their WordPress environments to confirm the removal of the affected version and monitor for indicators of compromise.