The WPFactory Custom CSS, JS & PHP plugin versions up to 2.4.1 contain a CSRF vulnerability that enables remote code inclusion. This vulnerability allows an attacker to trick an authenticated user into executing unwanted actions, potentially leading to remote code execution. The CVSS 3.1 base score of 9.6 reflects the critical nature of this flaw, with network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, and high impact on confidentiality, integrity, and availability. No patch or vendor advisory details are currently available, and no exploits have been reported in the wild.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary code remotely via CSRF, compromising the affected WordPress site’s confidentiality, integrity, and availability. This could lead to full site takeover or further attacks on connected systems. The critical CVSS score underscores the severity of the impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling or removing the affected plugin to mitigate risk. Monitor WPFactory communications and trusted vulnerability databases for updates. Avoid clicking on suspicious links or visiting untrusted sites while logged into WordPress admin to reduce CSRF risk.