Code Engine EUVD-2025-210455

Exploitation requires an authenticated WordPress account at Contributor level or above (PR:L in the CVSS vector) on a site where the Code Engine plugin ≤ 0.3.5 is installed and active; the concrete trigger is inserting the plugin's 'code-engine' shortcode into content, whose code-injecting functionality lacks an access restriction. Limiting factors that reduce real-world risk: the attacker must already possess (or be able to obtain, e.g. via open registration) a Contributor-or-higher account - fully anonymous exploitation is not possible; the site must have this specific plugin activated; and sites where only trusted administrators can author content have a much smaller exposure window. No non-default plugin configuration is required beyond having the plugin active and its shortcode reachable in content.

The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H = 8.8) indicates network-reachable, low-complexity exploitation requiring only low privileges (an authenticated Contributor account) and no user interaction, with full confidentiality, integrity, and availability impact - consistent with arbitrary code execution. The single meaningful barrier is authentication at Contributor level or above, which is common on multi-author blogs, membership sites, and any site allowing self-registration with contributor rights, but absent on tightly controlled single-admin sites. No EPSS score, KEV listing, or SSVC decision data was provided, and there is no public exploit identified at time of analysis, so this is not confirmed to be under active exploitation; the practical risk is 'reliable RCE once an attacker holds a low-tier account.' The primary uncertainty is deployment exposure: the danger is concentrated on sites that grant contributor+ accounts to semi-trusted or public users. Because the plugin's very function is executing code, exploitation is deterministic rather than probabilistic - treat as high priority wherever untrusted authors exist, lower where all authors are fully trusted administrators.

An attacker registers or is granted a Contributor account on a WordPress site running Code Engine ≤ 0.3.5 (for example, a multi-author blog or a site with open registration). They create a draft post containing a crafted '[code-engine]' shortcode carrying attacker-supplied PHP/commands; when the shortcode is processed the code executes on the web server in the context of the WordPress process, giving the attacker a webshell, data theft, or full site takeover. No public exploit is identified at time of analysis, but the low complexity and no-user-interaction requirement make reliable exploitation trivial for anyone holding the required role.