CVE-2026-4327: Welcomizer WordPress Plugin RCE Vulnerability

CVE-2026-4327 Overview

CVE-2026-4327 is a Remote Code Execution vulnerability in The Welcomizer plugin for WordPress affecting all versions up to and including 2.8.1. The flaw resides in the twiz_ajax_callback AJAX action handler, which processes the savesection case without a current_user_can() capability check. When a section is saved with the output choice twiz_logic_output, the plugin passes the attacker-controlled twiz_custom_logic POST parameter to PHP's eval() function. Because the required nonce is exposed to any authenticated user via the directly accessible twiz-ajax.js.php file, any authenticated attacker with Subscriber-level access or above can inject arbitrary PHP code and execute it on the site's frontend.

Critical Impact

Authenticated Subscriber-level users can achieve full remote code execution on the WordPress server, leading to complete site compromise, data theft, and lateral movement.

Affected Products

• The Welcomizer plugin for WordPress — all versions ≤ 2.8.1
• WordPress sites allowing user registration (default Subscriber role sufficient)
• WordPress installations exposing the plugin's twiz-ajax.js.php endpoint

Discovery Timeline

• 2026-09-19 - CVE-2026-4327 published to NVD
• 2026-09-21 - Last updated in NVD database

Technical Details for CVE-2026-4327

Vulnerability Analysis

The vulnerability is a Code Injection flaw classified under [CWE-94]. The plugin exposes an AJAX action, twiz_ajax_callback, registered through WordPress's wp_ajax_ hook. When the handler receives an action parameter of savesection, it validates a nonce but never verifies the caller's capabilities. This omission means any logged-in user, including the lowest-privileged Subscriber role, can reach the vulnerable code path.

The handler then processes the twiz_custom_logic POST parameter as executable PHP. When the section is later rendered on the frontend with output type twiz_logic_output, the stored payload is passed directly to eval() in includes/twiz.output.class.php around line 828. The attacker's PHP runs in the WordPress process context with full filesystem, database, and network access.

Root Cause

Two compounding defects create the vulnerability. First, the AJAX handler at twiz-ajax.php line 148 performs only a nonce check and skips authorization, violating the WordPress principle of pairing nonces with capability checks. Second, the plugin evaluates user-supplied text with eval(), an unsafe pattern for handling untrusted input. The nonce itself provides no meaningful barrier because twiz-ajax.js.php loads the WordPress bootstrap and echoes the nonce to any authenticated visitor.

Attack Vector

An attacker registers or uses an existing Subscriber-level account. The attacker requests twiz-ajax.js.php to retrieve a valid nonce. The attacker then sends a POST request to the admin-ajax.php endpoint with action=twiz_ajax_callback, the savesection sub-action, an output type of twiz_logic_output, and arbitrary PHP in the twiz_custom_logic field. When the affected section renders on the frontend, the injected PHP executes on the server.

See the Wordfence Vulnerability Report and the plugin source at twiz-ajax.php line 148 for the vulnerable handler.

Detection Methods for CVE-2026-4327

Indicators of Compromise

• POST requests to /wp-admin/admin-ajax.php containing action=twiz_ajax_callback and twiz_custom_logic parameters from low-privilege accounts.
• GET requests to the plugin's twiz-ajax.js.php file originating from newly created or Subscriber-level user sessions.
• Unexpected PHP files, webshells, or modifications under wp-content/uploads/ or the plugin directory following plugin activity.
• Outbound network connections from the PHP worker process to unfamiliar hosts shortly after a savesection request.

Detection Strategies

• Inspect web server access logs for twiz_ajax_callback POST bodies containing PHP tokens such as system(, passthru(, base64_decode(, or file_put_contents(.
• Enable WordPress audit logging for plugin option changes and section saves performed by non-administrative users.
• Deploy a Web Application Firewall (WAF) rule to block requests where twiz_custom_logic contains PHP function calls or backtick operators.

Monitoring Recommendations

• Monitor for new user registrations followed within minutes by AJAX calls to the Welcomizer endpoints.
• Alert on php-fpm or httpd child processes spawning shells (sh, bash, perl, python) on WordPress hosts.
• Track integrity of files under wp-content/plugins/the-welcomizer/ and the WordPress uploads directory using file integrity monitoring.

How to Mitigate CVE-2026-4327

Immediate Actions Required

• Deactivate and remove The Welcomizer plugin on all sites running version 2.8.1 or earlier until a patched release is verified.
• Disable open user registration (Settings → General → Anyone can register) to reduce the pool of accounts that can reach the vulnerable handler.
• Audit existing Subscriber accounts and remove any that were created without a legitimate business reason.
• Rotate WordPress secret keys in wp-config.php and force password resets if compromise is suspected.

Patch Information

At the time of publication, no fixed version is listed in the NVD entry. Monitor the The Welcomizer revision log and the Wordfence advisory for a patched release that adds a current_user_can() check to the savesection handler and removes the eval() sink.

Workarounds

• Block access to wp-content/plugins/the-welcomizer/twiz-ajax.js.php at the web server or WAF layer to prevent nonce disclosure.
• Add a WAF rule denying admin-ajax.php requests with action=twiz_ajax_callback when the authenticated user role is Subscriber.
• Set disable_functions in php.ini to restrict dangerous functions such as exec, system, passthru, and shell_exec to limit post-exploitation options.

# Example nginx rule to block the nonce-leaking endpoint
location ~* /wp-content/plugins/the-welcomizer/twiz-ajax\.js\.php$ {
    deny all;
    return 403;
}

# Example WAF signature (ModSecurity)
SecRule ARGS:action "@streq twiz_ajax_callback" \
    "id:1002026,phase:2,deny,status:403,\
    msg:'Block Welcomizer twiz_ajax_callback (CVE-2026-4327)',\
    chain"
    SecRule ARGS_NAMES "@rx twiz_custom_logic" "t:none"