This vulnerability in the NEX-Forms WordPress plugin involves improper sanitization of user input passed to the PHP function call_user_func() within the get_table_records function. Authenticated attackers with Custom-level privileges can invoke arbitrary PHP static methods or global functions that accept a single array parameter, resulting in limited code execution. The flaw is classified under CWE-94 (Improper Control of Generation of Code) and affects all plugin versions up to 8.9.1. The CVSS 3.1 base score is 6.3, reflecting network attack vector, low attack complexity, and privileges required but no user interaction.

Successful exploitation allows authenticated users with Custom-level access to execute arbitrary PHP functions under specific constraints, potentially leading to unauthorized actions affecting confidentiality, integrity, and availability of the WordPress site. The impact is limited by the requirement for authentication and the constraints on the functions that can be executed. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch links or official fixes are provided, users should monitor the vendor's announcements for updates. Until a fix is available, restrict Custom-level user access to trusted individuals only and consider disabling or limiting use of the affected plugin to reduce risk.