This vulnerability in Blocksy Companion Pro (<=2.1.45) arises from improper control over code generation, classified as CWE-94. It allows a contributor-level user to perform remote code execution (RCE), potentially leading to full compromise of the affected system. The CVSS 3.1 vector indicates network attack vector with high attack complexity, low privileges required, no user interaction, and a scope change, resulting in high impact on confidentiality, integrity, and availability. No patch or official remediation has been disclosed yet.

Successful exploitation allows an attacker with contributor-level privileges to execute arbitrary code remotely, potentially leading to full system compromise including data breach, system manipulation, and denial of service. The vulnerability affects confidentiality, integrity, and availability at a high level.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict contributor-level access to trusted users only and monitor for suspicious activity related to the plugin.