Comment by newguy33

Critical is an overstatement but it userland PHP execution does not equate to native process control. There are many situations where an attacker may have constrained PHP execution, gadget execution, template or plugin execution, deserialization reachability, or a sandboxed context, but not arbitrary native code execution or arbitrary memory write. Definitely impactful