CVE-2026-4327

Received Received - Intake

Remote Code Execution in Welcomizer WordPress Plugin

Publication date: 2026-09-19

Last updated on: 2026-09-19

Assigner: Wordfence

Description

The The Welcomizer plugin for WordPress is vulnerable to Remote Code Execution in all versions up to and including 2.8.1. This is due to missing authorization checks on the twiz_ajax_callback AJAX action's 'savesection' handler combined with the use of eval() to execute user-supplied 'custom logic' code on the frontend. The AJAX handler at twiz-ajax.php verifies a nonce but performs no current_user_can() capability check for the ACTION_SAVE_SECTION case. Furthermore, the nonce is exposed to any authenticated user through the directly-accessible twiz-ajax.js.php file which loads WordPress and outputs the nonce. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject arbitrary PHP code via the twiz_custom_logic POST parameter when saving a section with output choice 'twiz_logic_output'.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-19

Last Modified

2026-09-19

Generated

2026-09-20

AI Q&A

2026-09-20

EPSS Evaluated

N/A

NVD

CVE-2026-4327

Affected Vendors & Products

Vendor	Product	Version / Range
welcomizer	welcomizer	to 2.8.1 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-94	The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

Attack-Flow Graph

Executive Summary

The Welcomizer plugin for WordPress allows Remote Code Execution due to missing authorization checks on the twiz_ajax_callback AJAX action's 'savesection' handler. It uses eval() to execute user-supplied 'custom logic' code on the frontend. The AJAX handler verifies a nonce but lacks a capability check for saving sections. The nonce is exposed to any authenticated user, allowing attackers with Subscriber-level access or higher to inject arbitrary PHP code via the twiz_custom_logic POST parameter.

Detection Guidance

Detecting this vulnerability requires checking for the presence of the The Welcomizer plugin (versions up to 2.8.1) and verifying if the vulnerable AJAX action 'twiz_ajax_callback' with 'savesection' handler is accessible. Inspect WordPress installations for the plugin and review server logs for suspicious POST requests to twiz-ajax.php with the 'twiz_custom_logic' parameter.

Impact Analysis

An attacker could execute arbitrary PHP code on your WordPress site, leading to full system compromise. This includes stealing sensitive data, installing malware, defacing the site, or using it as a pivot point for further attacks. The impact is severe as it allows complete control over the affected website.

Compliance Impact

This vulnerability could lead to unauthorized access and data breaches, violating GDPR and HIPAA requirements for data protection and access control. Non-compliance may result in legal penalties, fines, and reputational damage due to exposed sensitive user data.

Mitigation Strategies

Immediately update the Welcomizer plugin to the latest version beyond 2.8.1. If an update is not available, consider disabling or removing the plugin entirely. Ensure all WordPress installations enforce strong authentication and limit user roles to the principle of least privilege.

Hi! I’m here to help you understand CVE-2026-4327. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70