CVE-2026-4327 describes a remote code execution vulnerability in The Welcomizer WordPress plugin (versions <=2.8.1). The flaw stems from missing authorization checks on the twiz_ajax_callback AJAX action's 'savesection' handler, which uses eval() to execute user-supplied 'custom logic' code. Although the AJAX handler verifies a nonce, it does not perform a current_user_can() capability check for the ACTION_SAVE_SECTION case. The nonce is accessible to any authenticated user via the twiz-ajax.js.php file, enabling attackers with Subscriber-level access or higher to inject arbitrary PHP code through the twiz_custom_logic POST parameter when saving a section with the 'twiz_logic_output' option.

Successful exploitation allows authenticated users with low privileges (Subscriber-level and above) to execute arbitrary PHP code remotely, leading to full compromise of the WordPress site. The CVSS 3.1 score of 8.8 reflects high impact on confidentiality, integrity, and availability.

No official patch or fix is currently documented. Users should restrict access to the plugin or disable it until a vendor-provided update is available. Monitor the vendor advisory for remediation guidance. Applying principle of least privilege to user roles may reduce risk but does not fully mitigate the vulnerability due to the exposed nonce and missing capability checks.