The Content No Cache plugin by Jose Mortellaro, versions up to 0.1.4, contains a code injection vulnerability due to improper control of code generation. This flaw allows remote attackers to inject code without authentication or user interaction, potentially leading to a complete compromise of confidentiality. The CVSS 3.1 base score is 8.6, indicating high severity with network attack vector, low attack complexity, no privileges required, and no user interaction needed. No patch or official remediation guidance is currently available.

Successful exploitation of this vulnerability could allow remote attackers to execute arbitrary code, compromising the confidentiality of the affected system. Integrity and availability impacts are not indicated. The vulnerability does not require privileges or user interaction, increasing its risk. No known exploits have been reported in the wild so far.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch or official fix is available, users should consider disabling or removing the affected plugin to mitigate risk. Monitor official Jose Mortellaro channels for updates on remediation.