Security Alert Summary
The WatchMan-Site7 WordPress plugin through 4.2.0 exposes an unrestricted debugging console that executes user-supplied PHP code. Any authenticated user, including low-privilege accounts such as subscribers, can use this console to run arbitrary code on the server.
CVE Details
- CVE ID: CVE-2026-77009
- Affected component: WatchMan-Site7 WordPress plugin
- Affected versions: Versions up to and including 4.2.0 (example affected version listed: 3.1.1 through 4.2.0)
- Published: September 2, 2026 at 3:17:39 PM
- Last modified: September 2, 2026 at 3:17:39 PM
- CVSS v3.1: Base Score 9.9, Severity CRITICAL, Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
- Authentication / privileges / user interaction: Authentication required: yes. Any authenticated user (for example, a subscriber). Privileges required: Low. User interaction: None.
- Primary impact: Confidentiality: High; Integrity: High; Availability: High
- Weakness: CWE-94 (Improper Control of Generation of Code)
Technical Details
The plugin includes a debugging console that executes PHP code supplied by users. Access to this console is not properly restricted, which means authenticated users with low privileges can submit PHP and have it executed on the server. Because the console executes arbitrary PHP, an attacker with an authenticated account can perform actions beyond normal role capabilities.
The root cause is a missing access control check on the debugging console mechanism. The CVE description indicates the console accepts and runs user-supplied PHP; no specific function names or REST endpoints are provided in the public data.
Impact is direct code execution on the server context running WordPress. That can allow reading or modifying stored data, executing operating system commands where PHP has such capability, or altering site content depending on the server environment and PHP configuration.
How This Could Impact Your Website
Consider a scenario where a site owner maintains multiple user accounts: administrators, editors, internal staff, and external contractors. If an external contributor who only needs a low-privilege account has an account on the site, they could access the debugging console and run PHP code. This could allow them to read or modify site data that would otherwise be protected, or execute actions that affect site availability.
Practical consequences include exposure of internal user email addresses, increased risk of targeted phishing or social engineering against staff, and unauthorized changes to site content or configuration. The severity of those consequences depends on what code the attacker can run and the server environment, but the core risk is arbitrary code execution by an authenticated low-privilege user.
If you’re unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review.
Recommended Actions
- Update the affected plugin as soon as a patched version is available.
- Remove or disable the debugging console or restrict access to trusted administrator accounts only, if possible.
- Review and reduce unnecessary user roles and capabilities, especially for contributors and other low-privilege accounts.
- Enforce strong passwords and enable two-factor authentication for editors and administrators.
- Remove unused or unmaintained plugins from your site.
- Monitor site activity and logs for unusual behavior, especially uploads, code execution attempts, and database queries initiated by low-privilege users.
If you’d like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.
