Custom CSS-JS-PHP WordPress Plugin Unauthenticated SQL Injection Leading to Remote Code Execution

A remote code execution vulnerability has been identified in the Custom CSS-JS-PHP WordPress plugin, versions 2.0.7 and prior. The issue arises because the plugin fails to properly sanitize user input before incorporating it into a SQL query. This unsanitized input is then evaluated using the eval() function, allowing unauthenticated users to execute arbitrary PHP code on the server.

Impact

Exploitation of this vulnerability allows for remote code execution on the server where the affected WordPress site is hosted.