CVE-2026-4327: The Welcomizer <= 2.8.1 - Missing Authorization to Authenticated (Subscriber+) Remote Code Execution via 'twiz_custom_logic' Parameter
The The Welcomizer plugin for WordPress is vulnerable to Remote Code Execution in all versions up to and including 2.8.1. This is due to missing authorization checks on the twizajaxcallback AJAX action's 'savesection' handler combined with the use of eval() to execute user-supplied 'custom logic' code on the frontend. The AJAX handler at twiz-ajax.php verifies a nonce but performs no currentusercan() capability check for the ACTIONSAVESECTION case. Furthermore, the nonce is exposed to any authenticated user through the directly-accessible twiz-ajax.js.php file which loads WordPress and outputs the nonce. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject arbitrary PHP code via the twizcustomlogic POST parameter when saving a section with output choice 'twizlogicoutput'.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WordPress Welcomizer pluginto a version that resolves this vulnerability.Fixed in 2.8.1 - Configuration
Add a capability/authorization check (current_user_can()) to the ACTION_SAVE_SECTION handler in the twiz_ajax_callback AJAX action in twiz-ajax.php before processing any requests.
Welcomizer WordPress plugin (twiz-ajax.php / twiz_ajax_callback savesection handler) current_user_can() authorization check for ACTION_SAVE_SECTION = true - Configuration
Do not execute user-supplied code from the twiz_custom_logic POST parameter via eval() on the frontend; remove/disable eval-based execution for twiz_custom_logic when saving sections with output choice 'twiz_logic_output'.
Welcomizer WordPress plugin (twiz-ajax.php / twiz_ajax_callback 'twiz_custom_logic' execution) eval() usage for user-supplied twiz_custom_logic = disabled - Compensating control
Restrict access to the AJAX endpoint (twiz-ajax.js.php / twiz-ajax.php) so only users with an appropriate administrative capability can call the twiz_ajax_callback 'savesection' handler.
Event History
Frequently Asked Questions
Which users can exploit this issue?
Any authenticated WordPress user with Subscriber-level access or higher can exploit it. The vulnerable AJAX handler checks a nonce but does not enforce a WordPress capability check.
Does an attacker need to obtain the nonce from an administrator or privileged user?
No. The nonce is exposed to authenticated users through the directly accessible twiz-ajax.js.php file, which loads WordPress and outputs the nonce.
What conditions are required for code execution?
An authenticated attacker must submit arbitrary PHP through the twiz_custom_logic POST parameter while saving a section configured with the twiz_logic_output output choice. The supplied custom logic is executed with eval() on the frontend.
Which plugin versions are affected?
All versions of The Welcomizer up to and including 2.8.1 are affected.