The vulnerability identified as CVE-2025-32222 affects Widget Logic versions up to 6.0.5. It is classified as an improper control of code generation, commonly known as code injection. This flaw allows an attacker with low privileges to inject and execute arbitrary code remotely without requiring user interaction. The CVSS 3.1 base score is 9.9, reflecting network attack vector, low attack complexity, no user interaction, and complete impact on confidentiality, integrity, and availability. No vendor patch or advisory details are currently available, and the product is not a cloud service.

Successful exploitation of this vulnerability could lead to full compromise of the affected system, including unauthorized disclosure, modification, or destruction of data, and disruption of service. Given the critical CVSS score and the nature of code injection, attackers could execute arbitrary code remotely with low privileges and no user interaction, potentially leading to complete system takeover.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, consider restricting access to the affected Widget Logic plugin, applying strict input validation where possible, and monitoring for suspicious activity related to the plugin. Avoid deploying this plugin in sensitive environments until a patch is available.