WordPress security by component
The Welcomizer
The Welcomizer (the-welcomizer) is a WordPress plugin with 1 published CVE record in this archive. The latest tracked vulnerability was published Sep 19, 2026; the highest published CVSS base score is 8.8.
Plugin slug:
the-welcomizerLatest vulnerability
CVE-2026-4327: The Welcomizer section editor lets Subscribers persist executable PHP
A Subscriber can obtain a valid nonce from directly accessible twiz-ajax.js.php and invoke the savesection handler of twiz_ajax_callback. The handler checks that nonce but not a capability. Attacker-controlled twiz_custom_logic saved with twiz_logic_output later reaches frontend eval(), producing server-side PHP execution. This is authenticated exploitation, not an anonymous upload or a nonce bypass. Authoritative affected range: <= 2.8.1. No fixed release is confirmed in this review.
| Safe version |
|
||
|---|---|---|---|
| Sep 19, 2026 |
CVE-2026-4327
The Welcomizer section editor lets Subscribers persist executable PHP
A Subscriber can obtain a valid nonce from directly accessible twiz-ajax.js.php and invoke the savesection handler of twiz_ajax_callback. The handler checks that nonce but not a capability. Attacker-controlled twiz_custom_logic saved with twiz_logic_output later reaches frontend eval(), producing server-side PHP execution. This is authenticated exploitation, not an anonymous upload or a nonce bypass. Authoritative affected range: <= 2.8.1. No fixed release is confirmed in this review.
|
See mitigation notes |
CVE8.8
|