A critical remote code execution vulnerability in The Welcomizer plugin allows authenticated users to compromise the underlying server environment.

The plugin suffers from improper control of code generation due to missing authorization checks in the twiz_ajax_callback AJAX handler. An authenticated attacker with subscriber privileges can bypass nonce verification to inject malicious PHP code into the twiz_custom_logic parameter, which is subsequently executed via eval().

The vulnerability carries a CVSS score of 8.8, indicating a high potential for full system compromise. Successful exploitation grants an attacker the ability to execute arbitrary code on the server, leading to potential data exfiltration, unauthorized administrative access, and complete system takeover. This creates significant risk for operational continuity and data integrity.

Immediate Action: As no official patch is available to resolve this issue, you must deactivate and remove The Welcomizer plugin immediately until a secure version is released by the vendor.

Proactive Monitoring: Review web server access logs for suspicious POST requests targeting twiz-ajax.php or anomalous modifications to plugin files.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block malicious PHP injection attempts or unauthorized access to the affected AJAX endpoint.

Public Exploit Available: Unknown

The severity of this flaw cannot be overstated, as it provides a direct path to remote code execution. Because no patched version currently exists, the only effective way to eliminate this risk is the total removal of the affected software from your WordPress environment. Please audit your installations to ensure this plugin is purged from all production and development instances.