This vulnerability in Marketing Fire Widget Options (<= 4.1.0) allows OS command injection due to improper neutralization of special elements used in commands. An attacker with low privileges can execute arbitrary operating system commands without user interaction, potentially leading to full system compromise. The CVSS 3.1 base score is 9.9, reflecting network attack vector, low attack complexity, no user interaction, and high impact on confidentiality, integrity, and availability. No official patch or fix has been disclosed yet.

Successful exploitation can lead to complete system compromise, including unauthorized disclosure, modification, or destruction of data, and disruption of service. The vulnerability allows remote attackers with low privileges to execute arbitrary OS commands, posing a critical risk to affected systems.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the vulnerable plugin and limit privileges of users who can interact with it to reduce risk.