CVE-2026-4327

Name of the Vulnerable Software and Affected Versions The Welcomizer plugin for WordPress versions prior to 2.8.2

Description Authenticated attackers with Subscriber-level access and above can achieve Remote Code Execution. The issue stems from missing authorization checks in the savesection handler of the twiz ajax callback AJAX action within the twiz-ajax.php endpoint. While the handler verifies a nonce, it fails to perform a current user can() capability check. Additionally, the nonce is exposed to authenticated users via the twiz-ajax.js.php file. This allows an attacker to inject arbitrary PHP code through the twiz custom logic parameter when the output choice is set to twiz logic output, which is then executed using the eval() function.

Recommendations Update The Welcomizer plugin to version 2.8.2 or later. As a temporary mitigation, restrict access to the twiz-ajax.php and twiz-ajax.js.php files for users with low-level privileges.