CVE-2025-67944CWE-94

WordPress Nelio AB Testing plugin <= 8.1.8 - Arbitrary Code Execution vulnerability

Critical · published January 22, 2026

CVSS v3.1
9.1
EPSS
1%
Percentile
47.0
In the wild
Unconfirmed
What it is

🔥 A crafty code injection vulnerability in Nelio AB Testing could let attackers run malicious code without raising any red flags! Picture a restaurant where the chef takes orders from customers without verifying them — a sneaky customer could ask for something totally bizarre, and the kitchen would whip it up without question! This vulnerability could lead to complete chaos, allowing attackers to execute their own code on your server. Imagine unauthorized access to sensitive user data or even taking control of the entire system. The potential for damage is absolutely devastating!

Put simply

Picture a restaurant where the chef takes orders from customers without verifying them — a sneaky customer could ask for something totally bizarre, and the kitchen would whip it up without question! This code injection flaw allows attackers to manipulate input data, leading the application to execute unintended commands. Affected versions range from n/a to 8.1.8, making it critical to act fast!

What to do

This vulnerability could lead to complete chaos, allowing attackers to execute their own code on your server. Imagine unauthorized access to sensitive user data or even taking control of the entire system. The potential for damage is absolutely devastating! Update Nelio AB Testing to version 8.1.9 or higher immediately to patch this vulnerability. It's also essential to validate and sanitize all input data to prevent future code injections. Don't wait until it's too late! You've got this! With swift action, you can lock down your application and keep those pesky attackers at bay! 🛡️

The record
Technical detail
CVSS v3.1
9.1 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00581 · 47.0th percentile
Weakness
CWE-94 · Improper Control of Generation of Code ('Code Injection')
Published
2026-01-22T16:51Z
EPSS history
Timeline
  • 22 JAN 16:51Z
    WordPress Nelio AB Testing plugin <= 8.1.8 - Arbitrary Code Execution vulnerability
    cvelistv5