CVE-2026-4327

Summary

The flaw allows remote code execution due to missing authorization checks and the use of eval() in the 'savesection' handler of the Welcomizer plugin for WordPress, posing a significant security risk.

Exploitability

Exploitation is moderately hard as it requires an authenticated user with Subscriber-level access and knowledge of the nonce, but the lack of a current_user_can() check makes it feasible.

Blast radius

If exploited, this vulnerability could lead to full server compromise, allowing attackers to inject and execute arbitrary PHP code, potentially leading to data theft, site defacement, or further attacks.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Disable the affected feature or upgrade to version 2.82 or later, as the fixed version is explicitly mentioned.

Analysis generated locally by qwen2.5:7b-instruct (no data left the box). AI-assisted — verify against primary sources before acting.