The Webhooks plugin for Craft CMS, versions 3.0.0 through 3.1.x, renders user‑supplied template content via Twig’s renderString() without any sandbox protection. This implementation flaw lets an authenticated user who can access the plugin through the Craft control panel inject arbitrary Twig code that invokes any PHP function. Consequently, an attacker can execute arbitrary server‑side code, compromising confidentiality, integrity, and availability of the affected system.

All installations of the Webhooks plugin from version 3.0.0 up to, but not including, 3.2.0 are affected. Users with control‑panel access and the appropriate permissions to manage the plugin are required to exploit the flaw; the issue persists even when the allowAdminChanges setting is disabled.

The CVSS score of 8.5 signals a high‑severity vulnerability. EPSS data is unavailable, and the issue is not listed in CISA’s KEV catalog. Exploitation requires authenticated access with plugin permissions, but does not depend on remote network access if the attacker can reach the control panel. Given the severity and lack of mitigation in older versions, the risk to affected installations is significant.