If you can control what gets written to the wx memory, then all you have to do as an attacker is rewrite a function pointer or return address to that memory. Be

If you can control what gets written to the wx memory, then all you have to do as an attacker is rewrite a function pointer or return address to that memory. Better yet, if you can rewrite a return address, you can "return" to a read call (or some fancier ROP chain) that will read the rest of your shellcode into the wx memory and execute it. In either case, having that kind of memory around can only make things easier for an attacker, while by itself not being exactly a vulnerability.