Description

The The Welcomizer plugin for WordPress is vulnerable to Remote Code Execution in all versions up to and including 2.8.1. This is due to missing authorization checks on the twiz_ajax_callback AJAX action's 'savesection' handler combined with the use of eval() to execute user-supplied 'custom logic' code on the frontend. The AJAX handler at twiz-ajax.php verifies a nonce but performs no current_user_can() capability check for the ACTION_SAVE_SECTION case. Furthermore, the nonce is exposed to any authenticated user through the directly-accessible twiz-ajax.js.php file which loads WordPress and outputs the nonce. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject arbitrary PHP code via the twiz_custom_logic POST parameter when saving a section with output choice 'twiz_logic_output'.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-09-19T08:16:53.887Z",
  "pubdate": "2026-09-19T08:16:53.887Z",
  "executiveSummary": "The Welcomizer plugin for WordPress contains a critical Remote Code Execution (RCE) vulnerability in versions up to and including 2.8.1.\nThe vulnerability arises from insecure AJAX handler implementation, where the 'savesection' functionality fails to perform authorization checks, combined with the dangerous use of the eval() function on user-supplied input.\nThis flaw allows authenticated users with Subscriber-level privileges or higher to execute arbitrary PHP code on the server.\nThe attack is facilitated by an information disclosure vulnerability in 'twiz-ajax.js.php', which inadvertently leaks the required security nonce to any authenticated user.\nBy leveraging this exposed nonce, an attacker can bypass intended security measures to inject and execute malicious 'custom logic' payloads via the 'twiz_custom_logic' POST parameter.\nThe impact of this vulnerability is total system compromise, as it permits unauthorized code execution within the context of the web server process, potentially leading to data exfiltration, site defacement, or persistent backdoors.",
  "technicalDetails": "The vulnerability is rooted in the 'twiz_ajax_callback' AJAX handler defined within the 'twiz-ajax.php' file of the Welcomizer plugin.\nThe handler processes the 'savesection' action by accepting user-supplied input via the 'twiz_custom_logic' parameter.\nThe application improperly handles this input by passing it directly into a PHP 'eval()' function when the 'output' choice is set to 'twiz_logic_output'.\nWhile the handler checks for a security nonce, it fails to perform a 'current_user_can()' capability check, effectively allowing any authenticated user to trigger the save action.\nThe security nonce requirement is rendered ineffective due to an information disclosure vulnerability in 'twiz-ajax.js.php'. This file directly loads the WordPress environment and outputs the active nonce to any authenticated user requesting the resource.\nThe attack flow proceeds as follows: First, an attacker with at least Subscriber-level access accesses 'twiz-ajax.js.php' to retrieve a valid, current nonce.\nSecond, the attacker constructs a malicious HTTP POST request targeting 'twiz-ajax.php' with the 'action' parameter set to 'savesection' and the 'nonce' parameter populated with the retrieved value.\nThird, the attacker injects arbitrary PHP code into the 'twiz_custom_logic' parameter.\nFinally, upon processing the request, the server executes the malicious payload within the 'eval()' function, granting the attacker full command execution capabilities on the host.\nThis vulnerability persists across all versions up to and including 2.8.1 and does not require elevated privileges, making it highly accessible to any compromised or malicious authenticated account on the target WordPress installation."
}