The vulnerability CVE-2025-8420 affects multiple versions of the emarket-design Campus Directory WordPress plugin that include the 'emd-form-builder-lite' package. It arises from the emd_form_builder_lite_pagenum function using user input as a function name without proper validation, leading to Eval Injection (CWE-95). This allows unauthenticated remote attackers to execute arbitrary code on the server, although they cannot supply parameters to the called functions. The CVSS 3.1 base score is 8.1, reflecting network attack vector, high complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. No patch or vendor advisory is currently provided, and no known exploits have been observed in the wild.

Successful exploitation of this vulnerability can lead to remote code execution on the affected server, potentially compromising confidentiality, integrity, and availability of the system. Since no privileges or user interaction are required, the attack surface is broad. However, the inability to pass parameters to the invoked functions may limit some exploitation techniques. There are no reports of active exploitation in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling or removing the vulnerable plugin to mitigate risk. Monitoring for updates from emarket-design is recommended. No vendor advisory or patch links are currently provided.