The Premmerce Dev Tools plugin for WordPress implements a function that creates new plugins based on user input. In versions up to and including 2.0, this function checks no user privileges before processing the request. It substitutes the supplied “premmerce_plugin_namespace” value directly into PHP stubs without sanitisation. An attacker who can authenticate as a Subscriber or higher can inject a PHP instruction after a semicolon, causing the generated file to contain and execute that code when served. This flaw is an example of CWE-434, allowing untrusted code execution on the server. If exploited, the attacker can gain full control over the hosting environment, read, modify, or delete data, and pivot to other systems.

WordPress installations running Premmerce Dev Tools version 2.0 or earlier. Any site that has the plugin enabled and contains a user account with Subscriber-level access or greater can exploit the vulnerability.

The CVSS score of 8.8 indicates high severity. The EPSS score is less than 1%, signalling that observed exploitation is extremely uncommon at the time of this analysis. The vulnerability is not listed in CISA KEV, but remote code execution remains available to authenticated users. The likely attack path involves submitting a crafted POST request to the plugin generation endpoint with a malicious namespace value; the attacker must already have WordPress login credentials to reach the endpoint.