Search

Find a vulnerability

Search criteria ⓘ Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.

    2 vulnerabilities by sebwordpress

    CVE-2026-4327 (GCVE-0-2026-4327)

    Vulnerability from nvd – Published: 2026-09-19 07:43 – Updated: 2026-09-19 14:01
    VLAI
    Title
    The Welcomizer <= 2.8.1 - Missing Authorization to Authenticated (Subscriber+) Remote Code Execution via 'twiz_custom_logic' Parameter
    Summary
    The The Welcomizer plugin for WordPress is vulnerable to Remote Code Execution in all versions up to and including 2.8.1. This is due to missing authorization checks on the twiz_ajax_callback AJAX action's 'savesection' handler combined with the use of eval() to execute user-supplied 'custom logic' code on the frontend. The AJAX handler at twiz-ajax.php verifies a nonce but performs no current_user_can() capability check for the ACTION_SAVE_SECTION case. Furthermore, the nonce is exposed to any authenticated user through the directly-accessible twiz-ajax.js.php file which loads WordPress and outputs the nonce. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject arbitrary PHP code via the twiz_custom_logic POST parameter when saving a section with output choice 'twiz_logic_output'.
    Severity
    8.8 (High)
    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
    SSVC
    Exploitation: none Automatable: no Technical Impact: total
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2026-09-19 13:23 UTC
    CWE
    • CWE-94 - Improper Control of Generation of Code ('Code Injection')
    Assigner
    References
    Impacted products
    Vendor Product Version
    sebwordpress The Welcomizer Affected: 0 , ≤ 2.8.1 (semver)
    		Create a notification for this product.
    Credits
    Nabil Irawan
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-4327",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-19T13:23:25.810413Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-19T14:01:23.048Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "The Welcomizer",
          "vendor": "sebwordpress",
          "versions": [
            {
              "lessThanOrEqual": "2.8.1",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Nabil Irawan"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The The Welcomizer plugin for WordPress is vulnerable to Remote Code Execution in all versions up to and including 2.8.1. This is due to missing authorization checks on the twiz_ajax_callback AJAX action\u0027s \u0027savesection\u0027 handler combined with the use of eval() to execute user-supplied \u0027custom logic\u0027 code on the frontend. The AJAX handler at twiz-ajax.php verifies a nonce but performs no current_user_can() capability check for the ACTION_SAVE_SECTION case. Furthermore, the nonce is exposed to any authenticated user through the directly-accessible twiz-ajax.js.php file which loads WordPress and outputs the nonce. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject arbitrary PHP code via the twiz_custom_logic POST parameter when saving a section with output choice \u0027twiz_logic_output\u0027."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-94",
              "description": "CWE-94 Improper Control of Generation of Code (\u0027Code Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-19T07:43:17.077Z",
        "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "shortName": "Wordfence"
      },
      "references": [
        {
          "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/73fb7102-66ff-4309-a98f-bbbfd3ddbba6?source=cve"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/the-welcomizer/trunk/includes/twiz.output.class.php#L828"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/the-welcomizer/tags/2.8.1/includes/twiz.output.class.php#L828"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/the-welcomizer/trunk/twiz-ajax.php#L148"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/the-welcomizer/tags/2.8.1/twiz-ajax.php#L148"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/the-welcomizer/trunk/includes/twiz.menu.class.php#L265"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/the-welcomizer/tags/2.8.1/includes/twiz.menu.class.php#L265"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/the-welcomizer/trunk/includes/twiz.menu.class.php#L507"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/the-welcomizer/tags/2.8.1/includes/twiz.menu.class.php#L507"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/the-welcomizer/trunk/includes/twiz.menu.class.php#L580"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/the-welcomizer/tags/2.8.1/includes/twiz.menu.class.php#L580"
        },
        {
          "url": "https://plugins.trac.wordpress.org/log/the-welcomizer/"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-09-18T19:27:36.000Z",
          "value": "Disclosed"
        }
      ],
      "title": "The Welcomizer \u003c= 2.8.1 - Missing Authorization to Authenticated (Subscriber+) Remote Code Execution via \u0027twiz_custom_logic\u0027 Parameter"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
    "assignerShortName": "Wordfence",
    "cveId": "CVE-2026-4327",
    "datePublished": "2026-09-19T07:43:17.077Z",
    "dateReserved": "2026-03-17T13:16:03.389Z",
    "dateUpdated": "2026-09-19T14:01:23.048Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-4327 (GCVE-0-2026-4327)

    Vulnerability from cvelistv5 – Published: 2026-09-19 07:43 – Updated: 2026-09-19 14:01
    VLAI
    Title
    The Welcomizer <= 2.8.1 - Missing Authorization to Authenticated (Subscriber+) Remote Code Execution via 'twiz_custom_logic' Parameter
    Summary
    The The Welcomizer plugin for WordPress is vulnerable to Remote Code Execution in all versions up to and including 2.8.1. This is due to missing authorization checks on the twiz_ajax_callback AJAX action's 'savesection' handler combined with the use of eval() to execute user-supplied 'custom logic' code on the frontend. The AJAX handler at twiz-ajax.php verifies a nonce but performs no current_user_can() capability check for the ACTION_SAVE_SECTION case. Furthermore, the nonce is exposed to any authenticated user through the directly-accessible twiz-ajax.js.php file which loads WordPress and outputs the nonce. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject arbitrary PHP code via the twiz_custom_logic POST parameter when saving a section with output choice 'twiz_logic_output'.
    Severity
    8.8 (High)
    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
    SSVC
    Exploitation: none Automatable: no Technical Impact: total
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2026-09-19 13:23 UTC
    CWE
    • CWE-94 - Improper Control of Generation of Code ('Code Injection')
    Assigner
    References
    Impacted products
    Vendor Product Version
    sebwordpress The Welcomizer Affected: 0 , ≤ 2.8.1 (semver)
    		Create a notification for this product.
    Credits
    Nabil Irawan
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-4327",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-19T13:23:25.810413Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-19T14:01:23.048Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "The Welcomizer",
          "vendor": "sebwordpress",
          "versions": [
            {
              "lessThanOrEqual": "2.8.1",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Nabil Irawan"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The The Welcomizer plugin for WordPress is vulnerable to Remote Code Execution in all versions up to and including 2.8.1. This is due to missing authorization checks on the twiz_ajax_callback AJAX action\u0027s \u0027savesection\u0027 handler combined with the use of eval() to execute user-supplied \u0027custom logic\u0027 code on the frontend. The AJAX handler at twiz-ajax.php verifies a nonce but performs no current_user_can() capability check for the ACTION_SAVE_SECTION case. Furthermore, the nonce is exposed to any authenticated user through the directly-accessible twiz-ajax.js.php file which loads WordPress and outputs the nonce. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject arbitrary PHP code via the twiz_custom_logic POST parameter when saving a section with output choice \u0027twiz_logic_output\u0027."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-94",
              "description": "CWE-94 Improper Control of Generation of Code (\u0027Code Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-19T07:43:17.077Z",
        "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "shortName": "Wordfence"
      },
      "references": [
        {
          "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/73fb7102-66ff-4309-a98f-bbbfd3ddbba6?source=cve"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/the-welcomizer/trunk/includes/twiz.output.class.php#L828"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/the-welcomizer/tags/2.8.1/includes/twiz.output.class.php#L828"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/the-welcomizer/trunk/twiz-ajax.php#L148"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/the-welcomizer/tags/2.8.1/twiz-ajax.php#L148"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/the-welcomizer/trunk/includes/twiz.menu.class.php#L265"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/the-welcomizer/tags/2.8.1/includes/twiz.menu.class.php#L265"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/the-welcomizer/trunk/includes/twiz.menu.class.php#L507"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/the-welcomizer/tags/2.8.1/includes/twiz.menu.class.php#L507"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/the-welcomizer/trunk/includes/twiz.menu.class.php#L580"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/the-welcomizer/tags/2.8.1/includes/twiz.menu.class.php#L580"
        },
        {
          "url": "https://plugins.trac.wordpress.org/log/the-welcomizer/"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-09-18T19:27:36.000Z",
          "value": "Disclosed"
        }
      ],
      "title": "The Welcomizer \u003c= 2.8.1 - Missing Authorization to Authenticated (Subscriber+) Remote Code Execution via \u0027twiz_custom_logic\u0027 Parameter"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
    "assignerShortName": "Wordfence",
    "cveId": "CVE-2026-4327",
    "datePublished": "2026-09-19T07:43:17.077Z",
    "dateReserved": "2026-03-17T13:16:03.389Z",
    "dateUpdated": "2026-09-19T14:01:23.048Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}