This vulnerability in FunnelFormsPro involves improper control over code generation, specifically enabling remote code inclusion. It affects versions up to 3.8.1 and is classified under CWE-94. The CVSS 3.1 score of 9.9 reflects network attack vector, low attack complexity, required privileges, no user interaction, and complete impact on confidentiality, integrity, and availability. The vendor has not provided a patch or official remediation guidance yet, and the product is not a cloud service, so remediation depends on vendor updates.

Successful exploitation of this vulnerability could allow an attacker with some privileges to remotely include and execute arbitrary code on the affected system. This can lead to full compromise of the confidentiality, integrity, and availability of the affected system. No known exploits are reported in the wild currently.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or temporary workaround is available, users should monitor vendor communications closely and consider restricting access to affected versions where possible until a patch is released.