The DoLeads Integrator and wp2epub WordPress plugins up to version 0.65 contain a code injection vulnerability (CWE-94) that can be exploited to achieve remote code execution. The issue arises from improper control over code generation, allowing unauthorized users to install unclosed extensions from wordpress.org, which can be leveraged to execute arbitrary code on the affected WordPress site. The vulnerability is critical with a CVSS 3.1 base score of 9.0, reflecting network exploitability without privileges or user interaction and complete compromise of confidentiality, integrity, and availability. As of the published date, no patch or official fix has been disclosed.

Successful exploitation of this vulnerability allows an attacker to execute arbitrary code remotely on the affected WordPress site, potentially leading to full system compromise. The impact includes complete loss of confidentiality, integrity, and availability of the affected system. This can result in unauthorized access, data theft, site defacement, or disruption of services.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict installation of plugins and extensions to trusted users only and monitor for unauthorized plugin installations. Consider disabling or removing the affected plugins if they are not essential to reduce exposure.