The4 Molla theme versions up to 1.5.13 contain an improper control of code generation vulnerability classified as code injection. This flaw could allow an attacker to inject and execute arbitrary code within the affected application. The vulnerability has a CVSS 3.1 base score of 6.5, reflecting medium severity with network attack vector and high attack complexity. No privileges or user interaction are required for exploitation, and the vulnerability impacts confidentiality, integrity, and availability. No patch or vendor advisory is currently provided, and no known exploits have been reported.

Successful exploitation could allow an attacker to execute arbitrary code, potentially leading to partial compromise of confidentiality, integrity, and availability of the affected system. However, the high attack complexity reduces the likelihood of exploitation. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, monitor for updates from The4 regarding patches or mitigations. Avoid deploying affected versions in high-risk environments if possible.