CVE-2026-4327 json
The Welcomizer <= 2.8.1 - Missing Authorization to Authenticated (Subscriber+) Remote Code Execution via 'twiz_custom_logic' Parameter
published last mo. modified last mo. also EUVD-2026-83548
- cvss
- 8.8
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.7%
- EPSS 0.7% chance of exploitation in 30 days, percentile 52%
- public exploits
- 0
- none known
Summary
The The Welcomizer plugin for WordPress is vulnerable to Remote Code Execution in all versions up to and including 2.8.1. This is due to missing authorization checks on the twiz_ajax_callback AJAX action's 'savesection' handler combined with the use of eval() to execute user-supplied 'custom logic' code on the frontend. The AJAX handler at twiz-ajax.php verifies a nonce but performs no current_user_can() capability check for the ACTION_SAVE_SECTION case. Furthermore, the nonce is exposed to any authenticated user through the directly-accessible twiz-ajax.js.php file which loads WordPress and outputs the nonce. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject arbitrary PHP code via the twiz_custom_logic POST parameter when saving a section with output choice 'twiz_logic_output'.
Is CVE-2026-4327 in your stack? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.
Check with FencerCISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- total
- Assessed
- last mo.
Exploit prediction
0.68% chance of exploitation in the next 30 days, higher than 52% of all scored CVEs (FIRST EPSS, 2026-11-09).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 8.8 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
Affected products
- sebwordpress The Welcomizer
Classification
- Weakness
-
- CWE-94 Improper Control of Generation of Code
- Technology feeds
References
- wordfence.com /threat-intel/vulnerabilities/id/73fb7102-66ff-4309-a98f-bbbfd3ddbba6?source=cve
- plugins.trac.wordpress.org /browser/the-welcomizer/trunk/includes/twiz.output.class.php#L828
- plugins.trac.wordpress.org /browser/the-welcomizer/tags/2.8.1/includes/twiz.output.class.php#L828
- plugins.trac.wordpress.org /browser/the-welcomizer/trunk/twiz-ajax.php#L148
- plugins.trac.wordpress.org /browser/the-welcomizer/tags/2.8.1/twiz-ajax.php#L148
- plugins.trac.wordpress.org /browser/the-welcomizer/trunk/includes/twiz.menu.class.php#L265
- plugins.trac.wordpress.org /browser/the-welcomizer/tags/2.8.1/includes/twiz.menu.class.php#L265
- plugins.trac.wordpress.org /browser/the-welcomizer/trunk/includes/twiz.menu.class.php#L507
- plugins.trac.wordpress.org /browser/the-welcomizer/tags/2.8.1/includes/twiz.menu.class.php#L507
- plugins.trac.wordpress.org /browser/the-welcomizer/trunk/includes/twiz.menu.class.php#L580
- plugins.trac.wordpress.org /browser/the-welcomizer/tags/2.8.1/includes/twiz.menu.class.php#L580
- plugins.trac.wordpress.org /log/the-welcomizer/
Sources
- CVE List CVE-2026-4327
- NVD CVE-2026-4327
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.