CVE-2026-4327 json
The Welcomizer <= 2.8.1 - Missing Authorization to Authenticated (Subscriber+) Remote Code Execution via 'twiz_custom_logic' Parameter
published 2026-09-19 50 d ago modified 2026-09-21 48 d ago also EUVD-2026-83548
- cvss
- 8.8
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.7%
- EPSS 0.7% chance of exploitation in 30 days, percentile 52%
- public exploits
- 0
- none known
Summary
The The Welcomizer plugin for WordPress is vulnerable to Remote Code Execution in all versions up to and including 2.8.1. This is due to missing authorization checks on the twiz_ajax_callback AJAX action's 'savesection' handler combined with the use of eval() to execute user-supplied 'custom logic' code on the frontend. The AJAX handler at twiz-ajax.php verifies a nonce but performs no current_user_can() capability check for the ACTION_SAVE_SECTION case. Furthermore, the nonce is exposed to any authenticated user through the directly-accessible twiz-ajax.js.php file which loads WordPress and outputs the nonce. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject arbitrary PHP code via the twiz_custom_logic POST parameter when saving a section with output choice 'twiz_logic_output'.
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- total
- Assessed
- 50 d ago
Exploit prediction
0.68% chance of exploitation in the next 30 days, higher than 52% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 8.8 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
Affected products
- sebwordpress The Welcomizer
Classification
- Weakness
-
- CWE-94 Improper Control of Generation of Code
References
- wordfence.com /threat-intel/vulnerabilities/id/73fb7102-66ff-4309-a98f-bbbfd3ddbba6?source=cve
- plugins.trac.wordpress.org /browser/the-welcomizer/trunk/includes/twiz.output.class.php#L828
- plugins.trac.wordpress.org /browser/the-welcomizer/tags/2.8.1/includes/twiz.output.class.php#L828
- plugins.trac.wordpress.org /browser/the-welcomizer/trunk/twiz-ajax.php#L148
- plugins.trac.wordpress.org /browser/the-welcomizer/tags/2.8.1/twiz-ajax.php#L148
- plugins.trac.wordpress.org /browser/the-welcomizer/trunk/includes/twiz.menu.class.php#L265
- plugins.trac.wordpress.org /browser/the-welcomizer/tags/2.8.1/includes/twiz.menu.class.php#L265
- plugins.trac.wordpress.org /browser/the-welcomizer/trunk/includes/twiz.menu.class.php#L507
- plugins.trac.wordpress.org /browser/the-welcomizer/tags/2.8.1/includes/twiz.menu.class.php#L507
- plugins.trac.wordpress.org /browser/the-welcomizer/trunk/includes/twiz.menu.class.php#L580
- plugins.trac.wordpress.org /browser/the-welcomizer/tags/2.8.1/includes/twiz.menu.class.php#L580
- plugins.trac.wordpress.org /log/the-welcomizer/
Sources
- CVE List CVE-2026-4327
- NVD CVE-2026-4327
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.