The vulnerability arises from the plugin's use of eval() on user-controlled Display Logic expressions without adequate sanitization or authorization checks on the extended_widget_opts_block attribute. This improper control of code generation (CWE-94) enables authenticated attackers with Contributor-level privileges or higher to execute arbitrary code remotely on the server. Although a partial patch was applied in version 4.2.0, versions up to and including 4.2.2 remain vulnerable. The CVSS 3.1 base score is 8.8, indicating high severity with network attack vector, low attack complexity, and no user interaction required.

Successful exploitation allows authenticated users with Contributor or higher privileges to achieve remote code execution on the server hosting the WordPress site. This can lead to full compromise of the affected system, including confidentiality, integrity, and availability impacts. The vulnerability affects all plugin versions up to 4.2.2, despite a partial patch in 4.2.0. No known exploits in the wild have been reported yet.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vulnerability was only partially patched in version 4.2.0 and remains in 4.2.2, users should monitor for an official full patch from the vendor. Until then, restrict Contributor-level access and above to trusted users only and consider disabling or removing the plugin if possible to mitigate risk.