This vulnerability in Marketing Fire Widget Options (<= 4.1.3) involves improper control over code generation, enabling an attacker to perform code injection. The CVSS 3.1 base score is 9.0 (critical), reflecting network attack vector, low complexity, required privileges, user interaction, and complete impact on confidentiality, integrity, and availability. The vulnerability allows an attacker to inject and execute arbitrary code within the context of the affected application, potentially leading to full system compromise.

Successful exploitation can result in full compromise of the affected system, including unauthorized disclosure of information, modification or destruction of data, and disruption of service. The vulnerability affects all versions of the Widget Options plugin up to and including 4.1.3. There are no known active exploits in the wild currently.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the affected plugin and limit privileges of users who can interact with it. Monitor for updates from the vendor and apply patches promptly once available.