The WPForms Google Sheet Connector plugin by WesternDeal suffers from an improper control of code generation vulnerability, classified as code injection. This flaw exists in versions up to 4.0.1 and allows attackers with low privileges to execute arbitrary code remotely without requiring user interaction. The vulnerability is critical with a CVSS 3.1 base score of 9.9, reflecting network attack vector, low attack complexity, and high impact on confidentiality, integrity, and availability. No patch or vendor advisory details are currently available to confirm remediation status.

Successful exploitation of this vulnerability could lead to complete compromise of the affected system, including unauthorized code execution, data disclosure, data modification, and denial of service. The high CVSS score reflects the critical nature of the impact on confidentiality, integrity, and availability. No known exploits have been reported in the wild so far.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider restricting access to the affected plugin and monitoring for suspicious activity related to WPForms Google Sheet Connector. Avoid deploying this plugin in sensitive environments if possible.