External risk intelligence

Cwicly Plugin Contributor Remote Code Execution

CVE advisorySeverity: CRITICAL (CVSS 9.9)

CVE-2026-32444

Cwicly is a WordPress plugin used for website building. WordPress sites and their plugins are typically deployed as public-facing web applications, making this functionality commonly reachable via the internet as part of the standard web server environment.

Code Injection

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability has been identified in Cwicly, a tool used for website development. This issue could allow for unauthorized execution of code on affected systems, potentially impacting the integrity and availability of online services. The primary concern at this time is to determine if our environment utilizes this specific technology.

Code execution flaw in website builder.
Understand its potential impact on our systems.
Confirm if Cwicly is in use here.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this vulnerability by sending a specially crafted request to a site using the affected plugin. This could allow them to execute arbitrary code on the server, potentially leading to a full compromise of the website and its data.

Requires low privileges and no user interaction.
Achieved by sending a malicious network request.
Leads to critical remote code execution.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an unauthenticated attacker to execute arbitrary code on the server when interacting with specific plugin functionalities. This could lead to a complete compromise of the affected WordPress site.

Server-side code execution.
Unauthenticated interaction with plugin.
Complete website compromise.

Operational Fix

Recommended remediation, mitigation, and detection steps

This critical vulnerability in Cwicly could allow for remote code execution and impacts systems using versions prior to 1.4.4. The first step is to identify all instances of Cwicly across your web application infrastructure, confirm their reachability and business criticality, and then assign ownership for remediation planning.

Application owners should address this issue.
Verify Cwicly's exposure and criticality.
Plan remediation considering maintenance windows.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Cwicly plugin used for?

Cwicly is a WordPress plugin designed to assist users in building and customizing websites. It functions as a development tool that integrates directly into the WordPress environment to help site administrators create complex layouts and design elements without requiring extensive custom coding.

What does CWE-94 mean for CVE-2026-32444?

CWE-94 refers to improper control of generation of code, often called code injection. In the context of this CVE, it means the plugin fails to properly sanitize input, allowing an attacker to inject and execute their own unauthorized commands or scripts on the server where the website is hosted.

How is this Cwicly vulnerability triggered?

An attacker triggers the flaw by sending a specially crafted network request to the affected website. Because the vulnerability lies within the plugin's handling of these requests, it does not require the attacker to have high-level administrative access or any interaction from a legitimate user to succeed.

Is my site at risk if it uses Cwicly?

According to Halo Surface Signal, Cwicly is typically deployed as part of a public-facing web server environment. Because the plugin is designed to be accessible as part of a website's standard operation, any instance reachable via the internet should be considered potentially exposed to this vulnerability.

How do I respond to this Cwicly threat?

Your first step is to conduct an inventory to locate all instances of Cwicly across your web infrastructure. Once identified, confirm the specific version in use, determine the business criticality of the affected site, and assign ownership to ensure the software is updated or secured according to your maintenance schedule.

References

patchstack.com/database/wordpress/plugin/cwicly/vulnerability/wordpr…

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.