The Custom css-js-php WordPress plugin through version 2.0.7 suffers from improper control of code generation (CWE-94). Specifically, it fails to sanitize user input before incorporating it into a SQL query. The output of this query is then passed to the PHP eval() function, allowing unauthenticated attackers to execute arbitrary PHP code remotely. This vulnerability has a CVSS 3.1 base score of 7.3, indicating high severity, with network attack vector, no privileges required, no user interaction, and impacts on confidentiality, integrity, and availability.

Successful exploitation allows unauthenticated attackers to execute arbitrary PHP code on the server hosting the vulnerable plugin. This can lead to unauthorized access, data leakage, modification, or destruction, and potentially full system compromise depending on the server environment and privileges of the web server process.

Patch status is not yet confirmed — no official fix or remediation level has been published by the vendor as of the current information. Users should monitor the vendor's advisory channels for updates and apply any official patches once available. Until then, consider disabling or removing the affected plugin version to mitigate risk.