The WP Ultimate Exporter plugin for WordPress, versions up to 2.9.1, contains an improper control of code generation vulnerability classified as code injection. This flaw enables PHP Remote File Inclusion, which can allow an attacker with high privileges to execute arbitrary code remotely, potentially leading to full system compromise. The CVSS v3.1 base score is 9.1, reflecting critical severity with network attack vector, low attack complexity, high privileges required, no user interaction, and complete impact on confidentiality, integrity, and availability.

Successful exploitation of this vulnerability can result in remote code execution through PHP Remote File Inclusion, allowing attackers to fully compromise the affected WordPress environment. This includes unauthorized disclosure, modification, or destruction of data and disruption of service. The critical CVSS score indicates a severe impact on affected systems.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor Smackcoders Inc. communications for updates. In the meantime, restrict access to high-privilege accounts and consider disabling or removing the WP Ultimate Exporter plugin if not essential.