The vulnerability identified as CVE-2026-22390 affects Builderall Builder for WordPress versions up to 3.0.1. It is characterized by improper control over code generation, enabling an attacker to perform code injection. The CVSS 3.1 base score is 9.9, indicating critical severity, with network attack vector, low attack complexity, low privileges required, no user interaction, and scope changed. The impact includes high confidentiality, integrity, and availability loss. No patch or remediation information is currently provided, and no known exploits are reported in the wild.

Exploitation of this vulnerability could allow an attacker to inject and execute arbitrary code within the affected WordPress plugin environment. This can lead to full compromise of the affected system, including unauthorized access to sensitive data, modification or destruction of data, and disruption of service. Given the critical CVSS score and the nature of the vulnerability, the impact is severe.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are provided at this time. Until a patch is available, users should consider disabling or removing the affected plugin to mitigate risk. Monitor vendor communications for updates on remediation.