CVE-2026-4327 Code injection in The Welcomizer
Authenticated attackers with Subscriber access can execute arbitrary PHP code via the twiz_custom_logic parameter due to missing authorization checks and eval usage.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-4327?
CVE-2026-4327 is a high-severity code injection vulnerability in sebwordpress The Welcomizer, published on 19 Sep 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
The The Welcomizer plugin for WordPress is vulnerable to Remote Code Execution in all versions up to and including 2.8.1. This is due to missing authorization checks on the twiz_ajax_callback AJAX action's 'savesection' handler combined with the use of eval() to execute user-supplied 'custom logic' code on the frontend. The AJAX handler at twiz-ajax.php verifies a nonce but performs no current_user_can() capability check for the ACTION_SAVE_SECTION case. Furthermore, the nonce is exposed to any authenticated user through the directly-accessible twiz-ajax.js.php file which loads WordPress and outputs the nonce. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject arbitrary PHP code via the twiz_custom_logic POST parameter when saving a section with output choice 'twiz_logic_output'.
Weakness: CWE-94
Which versions are affected by CVE-2026-4327?
How do I fix CVE-2026-4327?
No fix has been published for CVE-2026-4327 yet. Limit exposure of the affected software until one is available.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2026-4327 being exploited?
There is no known exploitation of CVE-2026-4327 in the wild and no public exploit code.
Sources
Also known as GHSA-fmwg-rf74-rjqj.