Remote Code Execution Vulnerability in The Welcomizer Plugin by WordPress

CVE-2026-4327

What is CVE-2026-4327?

The Welcomizer plugin for WordPress has a serious vulnerability due to insufficient authorization checks in the AJAX handler twiz_ajax_callback, specifically the 'savesection' action. This flaw allows malicious actors with authenticated access to inject and execute arbitrary PHP code through the 'twiz_custom_logic' POST parameter. The nonce verification is inadequate, as it does not check user capabilities beyond nonce validation, permitting even low-level subscribers to exploit this weakness. In addition, the nonce is made accessible to all authenticated users, increasing the risk of exploitation.

References