This vulnerability in Themeisle Woody ad snippets (<= 2.7.1) involves improper control of code generation, specifically code injection via the insert-php functionality. An attacker with low privileges can exploit this flaw to execute arbitrary code remotely without requiring user interaction. The CVSS 3.1 base score is 9.9, reflecting network attack vector, low attack complexity, low privileges required, no user interaction, and complete impact on confidentiality, integrity, and availability. No official patch or fix information is available at this time.

Successful exploitation allows an attacker to execute arbitrary code on the affected system, potentially leading to full system compromise, data theft, or service disruption. The vulnerability affects all versions of Woody ad snippets up to and including 2.7.1. Given the critical CVSS score, the impact is severe across confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the plugin's functionality to trusted users only and monitor for suspicious activity related to code injection attempts. Avoid deploying this plugin in sensitive environments or consider disabling it temporarily.