CVE-2026-4327 sebwordpress CVE debrief

Who should care

WordPress site administrators and security teams should assess exposure and apply patches due to the high CVSS score of 8.8 and the potential for Remote Code Execution. They should also review the plugin's codebase for any potential security vulnerabilities and implement additional security measures to prevent similar attacks.

Why it matters

CVE-2026-4327 is a high-severity vulnerability in the Welcomizer plugin for WordPress, allowing Remote Code Execution. WordPress site administrators and security teams should assess exposure and apply patches.

• Potential for Remote Code Execution by authenticated attackers with Subscriber-level access and above
• Possible injection of arbitrary PHP code via the twiz_custom_logic POST parameter
• Exposure of the nonce to any authenticated user through the directly-accessible twiz-ajax.js.php file
• Need for verification of affected versions and remediation efforts

Technical summary

The Welcomizer plugin for WordPress is vulnerable to Remote Code Execution in all versions up to and including 2.8.1. This is due to missing authorization checks on the twiz_ajax_callback AJAX action's 'savesection' handler combined with the use of eval() to execute user-supplied 'custom logic' code on the frontend. The AJAX handler at twiz-ajax.php verifies a nonce but performs no current_user_can() capability check for the ACTION_SAVE_SECTION case. Furthermore, the nonce is exposed to any authenticated user through the directly-accessible twiz-ajax.js.php file which loads WordPress and outputs the nonce. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject

Defensive priority

High priority for WordPress site administrators and security teams to assess exposure and apply patches.

Recommended defensive actions

• Assess exposure by checking if the Welcomizer plugin version is 2.8.1 or earlier.
• Apply patches or updates to the Welcomizer plugin to address the vulnerability.
• Monitor for suspicious activity related to the twiz_ajax_callback AJAX action.
• Review and restrict access to the twiz-ajax.js.php file.
• Verify the integrity of the Welcomizer plugin's codebase.
• Conduct regular security audits to identify potential vulnerabilities.
• Implement additional security measures to prevent similar attacks.

Evidence notes

The CVE record and NVD detail page provide information on the vulnerability, including its CVSS score of 8.8 and weaknesses related to CWE-94. Multiple source references from [email protected] provide additional context.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.