CVE-2026-32261 in Webhooks Plugin
Summary
by MITRE • 03/16/2026
Webhooks for Craft CMS plugin adds the ability to manage “webhooks” in Craft CMS, which will send GET or POST requests when certain events occur. From version 3.0.0 to before version 3.2.0, the Webhooks plugin renders user-supplied template content through Twig’s renderString() function without sandbox protection. This allows an authenticated user with access to the Craft control panel and permissions to access the Webhooks plugin to inject Twig template code that calls arbitrary PHP functions. This is possible even if allowAdminChanges is set to false. This issue has been patched in version 3.2.0.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 03/22/2026
The vulnerability identified as CVE-2026-32261 affects the Webhooks plugin for Craft CMS, a popular content management system used by organizations worldwide for web content management. This security flaw exists within the plugin's handling of user-supplied template content, specifically when rendering Twig templates through the renderString() function. The vulnerability represents a critical server-side template injection issue that allows authenticated attackers to execute arbitrary PHP code on the affected system. The flaw impacts versions 3.0.0 through 3.1.9 of the Webhooks plugin, making it a persistent threat across multiple releases until the patch was implemented in version 3.2.0.
The technical exploitation of this vulnerability occurs through the improper use of Twig's renderString() function, which lacks sandbox protection mechanisms that would normally prevent dangerous template operations. When an authenticated user with sufficient privileges accesses the Craft CMS control panel and navigates to the Webhooks plugin interface, they can inject malicious Twig template code into webhook configurations. This code can then execute arbitrary PHP functions through Twig's template engine capabilities, bypassing standard security restrictions. The vulnerability is particularly concerning because it can be exploited even when the Craft CMS configuration has allowAdminChanges set to false, which typically restricts administrative modifications to prevent unauthorized changes. This demonstrates how the flaw operates at a deeper level within the template rendering system rather than simply bypassing administrative controls.
The operational impact of CVE-2026-32261 extends beyond simple code execution, as it enables attackers to perform a wide range of malicious activities on compromised systems. Successful exploitation allows threat actors to access sensitive data, modify content, escalate privileges, and potentially establish persistent access through backdoor creation or other malicious operations. The vulnerability affects organizations using Craft CMS with the Webhooks plugin, potentially exposing them to data breaches, content tampering, and system compromise. Given that the plugin requires administrative access to exploit, the attack surface is limited to users with legitimate access credentials, making this a significant insider threat vulnerability. The issue aligns with CWE-74 and CWE-94 classifications, representing both injection vulnerabilities and code injection through template engines. From an ATT&CK framework perspective, this vulnerability maps to T1190 (Exploit Public-Facing Application) and T1059.007 (Command and Scripting Interpreter: PowerShell), as it enables arbitrary code execution through template injection.
Organizations affected by this vulnerability should immediately upgrade to version 3.2.0 or later of the Webhooks plugin to remediate the issue. System administrators should conduct thorough security audits of their Craft CMS installations to identify any potential exploitation attempts. Additional mitigation strategies include implementing network segmentation, monitoring for unusual webhook activity, and reviewing user access permissions to minimize potential attack vectors. The vulnerability highlights the importance of proper input sanitization and sandboxing mechanisms in template engines, particularly when dealing with user-supplied content. Security teams should also consider implementing web application firewalls and runtime application self-protection measures to detect and prevent exploitation attempts. Regular security assessments and vulnerability scanning should be conducted to identify similar issues in other CMS plugins and applications that may be susceptible to template injection attacks.