EUVD-2026-37033
GHSA-gjvr-7x7p-x3vq
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessRegister or obtain Subscriber-level WordPress account
-
DeliveryLog in and obtain admin-ajax nonce
-
ExploitPOST to generatePluginHandler with malicious premmerce_plugin_namespace
-
ExecutionStub written to wp-content/plugins/ with injected PHP
-
PersistRequest generated plugin file via HTTP
-
ImpactExecute arbitrary commands as web server user
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V5 - File Handling File type validation, storage isolation
MITRE ATT&CK
2 techniques across 2 tactics: Command and Control, Persistence The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires (1) a WordPress site running Premmerce Dev Tools ≤ 2.0 with the plugin activated, (2) an authenticated session at Subscriber role or higher - meaning either open user registration is enabled (Settings → General → 'Anyone can register') or the attacker has obtained valid credentials for any existing low-privileged account, and (3) network reachability to wp-admin endpoints. The payload must inject a semicolon into the premmerce_plugin_namespace POST parameter to escape the PHP namespace declaration context in the generated stub. No user interaction by a victim is required, no non-default plugin configuration is needed beyond having the plugin installed, and the wp-content/plugins/ directory must be writable by the web server (the default in nearly all WordPress installations). |
| Impact | The CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H vector aligns cleanly with the description: network-reachable WordPress admin endpoint, low complexity (just craft a POST), only Subscriber privileges required, and full RCE impact. EPSS and CISA KEV data were not provided in the input, so probability of mass exploitation cannot be quantified from available signals - however, Wordfence-reported WordPress plugin RCEs with Subscriber-level prerequisites are historically a magnet for opportunistic scanning once disclosed. The real-world risk is concentrated on sites that permit user registration (WooCommerce, membership, BuddyPress, etc.); sites that disable registration and have no Subscriber accounts require an account compromise first, materially limiting exposure. No public exploit identified at time of analysis, but the technical writeup essentially describes the payload shape, so PoC development is trivial. |
| Exploit ScenarioDerived | An attacker registers a free Subscriber account on a WordPress site that has Premmerce Dev Tools installed (common on WooCommerce or membership sites), then sends an authenticated POST to the admin endpoint that invokes generatePluginHandler with premmerce_plugin_namespace set to a value like 'Foo; system($_GET["c"]); //'. The server writes the payload into a new PHP file under wp-content/plugins/, after which the attacker requests that file over HTTP with a ?c=id query string to execute commands as the web server user, pivoting to webshell deployment and full site takeover. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jun 16, 2026
Remote code execution in the Premmerce Dev Tools WordPress plugin (versions ≤ 2.0) allows authenticated users with Subscriber-level access or higher to write arbitrary PHP files into wp-content/plugins/ by injecting payloads into the premmerce_plugin_namespace POST parameter. The flaw stems from a missing authorization check in generatePluginHandler combined with unsanitized string substitution in createFromStub, enabling attackers to escape the namespace context with a semicolon and execute arbitrary PHP on the host. No public exploit identified at time of analysis, but the low privilege barrier and the high-impact CVSS 8.8 score make this a serious risk on sites with open registration.
RemediationAI
No vendor-released patch identified at time of analysis - the references point to vulnerable trunk and tag 2.0 sources with no fixed version published, so the primary recommended action is to deactivate and delete the Premmerce Dev Tools plugin until the vendor ships a release that adds a current_user_can('manage_options') (or equivalent) check in generatePluginHandler and properly validates premmerce_plugin_namespace against a strict identifier regex. As compensating controls while waiting for an upstream fix, restrict access to /wp-admin/admin-ajax.php and /wp-admin/admin-post.php for unauthenticated and Subscriber-role users at the WAF or reverse proxy (note: this can break legitimate front-end AJAX features such as add-to-cart or comment submission), disable new user self-registration via Settings → General → Membership (side effect: blocks legitimate signups for WooCommerce/membership sites), and monitor wp-content/plugins/ for newly created directories or PHP files written outside of plugin install workflows. Monitor https://www.wordfence.com/threat-intel/vulnerabilities/id/c43c060b-7a18-49ee-a753-ae1ed2f7e04d for the patched version announcement.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability lives in Premmerce Dev Tools' PluginGenerator subsystem, a developer utility that scaffolds new WordPress plugins from PHP stub templates. According to the linked source at PluginGenerator.php#L125, the createFromStub routine performs naive string replacement of the premmerce_plugin_namespace parameter directly into PHP stub files before writing them to wp-content/plugins/, never validating that the value is a legal PHP namespace identifier. Compounding this, Admin.php#L107 registers generatePluginHandler as an AJAX/admin-post action without a capability check or nonce gating that restricts it to administrators. CWE-434 (Unrestricted Upload of File with Dangerous Type) captures the root cause: a trusted server-side file-write primitive is exposed to low-privileged users who control its filename and content. The CPE cpe:2.3:a:premmerce:premmerce_dev_tools:*:* confirms all distributed versions through 2.0 are in scope.
Know when Premmerce Dev Tools gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Network-reachable wp-admin endpoint (AV:N), single crafted POST (AC:L), requires authenticated Subscriber account (PR:L), no victim interaction (UI:N), and arbitrary PHP execution yields full C/I/A impact.
Primary rating from Vendor (Wordfence).
CVSS VectorNVD
DescriptionNVD
The Premmerce Dev Tools plugin for WordPress is vulnerable to Remote Code Execution via missing authorization in versions up to and including 2.0. This is due to the 'generatePluginHandler' function lacking any authorization check before processing user-supplied POST data, combined with the 'createFromStub' function performing unsanitized string substitution of the 'premmerce_plugin_namespace' parameter directly into PHP stub files written to the wp-content/plugins/ directory. An attacker can inject a semicolon followed by arbitrary PHP code into the namespace parameter, causing the generated plugin file to contain and execute that code when accessed via HTTP. This makes it possible for authenticated attackers with Subscriber-level access and above to create arbitrary PHP files on the server and achieve remote code execution.
Executive ViewAI
The Premmerce Dev Tools WordPress plugin (versions 2.0 and earlier) contains a high-severity remote code execution vulnerability enabling even basic subscribers to execute arbitrary PHP code on affected servers. Organizations using this plugin face substantial risk of server compromise, data exfiltration, and malware deployment-particularly acute for sites with open user registration or untrusted subscriber access.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) Immediate plugin removal or deactivation; (2) File integrity monitoring on wp-content/plugins/ directory to detect unauthorized PHP file creation; (3) Web Application Firewall rules blocking PHP execution in content/upload directories; (4) Subscriber role permission hardening to restrict POST parameter manipulation; (5) Enhanced monitoring and alerting for premmerce_plugin_namespace POST parameter injection attempts.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Malicious file upload attacks exploit insufficient validation when web applications accept user-provided files.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Exploit-DB