Description
The WatchMan-Site7 WordPress plugin through 4.2.0 does not restrict access to its debugging console, which executes user-supplied PHP code, allowing any authenticated user, such as a subscriber, to run arbitrary code on the server.
Published: 2026-09-02
Score: 9.9 Critical
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The WatchMan‑Site7 WordPress plugin, up through version 4.2.0, fails to restrict access to its debugging console. Once accessed, the console executes user‑supplied PHP code, allowing any authenticated user—even a subscriber role—to run arbitrary code on the hosting server. This flaw is a classic code‑injection weakness (CWE‑94) and may lead to full server compromise.

Affected Systems

The vulnerability affects the WatchMan‑Site7 WordPress plugin, version 3.1.1 through 4.2.0. The vendor is listed as Unknown:WatchMan‑Site7, with no further vendor details available.

Risk and Exploitability

The software carries a CVSS score of 9.9, indicating critical severity. The EPSS score is not available, but the flaw permits exploitation by any logged‑in user, making the attack vector simple and readily achievable. The vulnerability is not currently listed in the CISA KEV catalog, yet the high severity and logical exploitation path warrant immediate attention.

Generated by OpenCVE AI on September 3, 2026 at 11:33 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Update the WatchMan‑Site7 plugin to the latest available version that closes the debugging console access flaw.
  • If an update is not available, immediately disable or delete the debugging console component from the plugin or restrict its execution permissions to a high‑privilege role only.
  • Enforce the principle of least privilege by ensuring that only administrators can access debugging or scripting interfaces in the WordPress environment.

Generated by OpenCVE AI on September 3, 2026 at 11:33 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 02 Sep 2026 16:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Wed, 02 Sep 2026 10:45:00 +0000

Type Values Removed Values Added
Description The WatchMan-Site7 WordPress plugin through 4.2.0 does not restrict access to its debugging console, which executes user-supplied PHP code, allowing any authenticated user, such as a subscriber, to run arbitrary code on the server.
Title WatchMan-Site7 3.1.1 - 4.2.0 - Subscriber+ RCE via Debug Console
Weaknesses CWE-94
References
Metrics cvssV3_1

{'score': 9.9, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H'}

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: WPScan

Published:

Updated: 2026-09-02T14:57:37.812Z

Reserved: 2026-08-20T07:38:30.480Z

Link: CVE-2026-77009

cve-icon Vulnrichment

Updated: 2026-09-02T14:44:09.150Z

cve-icon NVD

Status : Deferred

Published: 2026-09-02T15:17:39.410

Modified: 2026-09-03T17:50:37.690

Link: CVE-2026-77009

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-03T11:45:03Z

Weaknesses
  • CWE-94

    Improper Control of Generation of Code ('Code Injection')