What is the CVSS score of EUVD-2026-70039?

EUVD-2026-70039 has a CVSS 3.1 base score of 9.9 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of WatchMan-Site7 are affected by EUVD-2026-70039?

The WatchMan-Site7 WordPress plugin (all versions through 4.2.0) contains a critical vulnerability enabling any subscriber-level account to execute arbitrary code and fully compromise the web server.

Is there a public PoC exploit available for EUVD-2026-70039?

Yes, a public proof-of-concept exploit is available for EUVD-2026-70039. Prioritise patching immediately. EPSS: 0.3%.

How to fix or mitigate EUVD-2026-70039?

Within 24 hours: disable or immediately remove the WatchMan-Site7 plugin from all WordPress installations. Within 7 days: audit all subscriber and contributor-level accounts for suspicious activity, review web server access logs for unexpected PHP execution, and identify all sites running WatchMan-Site7 versions through 4.2.0 using your WordPress inventory. Within 30 days: evaluate alternative plugins for required functionality, implement least-privilege access controls for WordPress user roles to restrict subscriber capabilities, and establish monitoring for any PHP-execution abuse patterns; maintain contact with the vendor to track patch availability and timeline.

WatchMan-Site7 EUVD-2026-70039

| CVE-2026-77009 CRITICAL

Code Injection (CWE-94)

2026-09-02 WPScan

GHSA-j83j-cm7x-4gpc

PHP WordPress RCE Code Injection Watchman Site7 Unknown

9.9

CVSS 3.1 · Vendor: WPScan

Severity by source

Vendor (WPScan) PRIMARY

9.9 CRITICAL

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Network-reachable console needs only a subscriber account (PR:L), no interaction; PHP execution yields full C/I/A, but RCE stays within the host process so S:U rather than S:C.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (WPScan).

CVSS VectorVendor: WPScan

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

POC Analysis Generated

Sep 02, 2026 - 15:22 vuln.today

Analysis Generated

Sep 02, 2026 - 15:07 vuln.today

CVE Published

Sep 02, 2026 - 14:16 cve.org

CRITICAL 9.9

DescriptionCVE.org

The WatchMan-Site7 WordPress plugin through 4.2.0 does not restrict access to its debugging console, which executes user-supplied PHP code, allowing any authenticated user, such as a subscriber, to run arbitrary code on the server.

Articles & Coverage 1

News Critical RCE in WatchMan-Site7 WordPress Plugin through 4.2.0 - CVE-2026-77009 Sep 03, 2026

AnalysisAI

Remote code execution in the WatchMan-Site7 WordPress plugin (all versions through 4.2.0) allows any authenticated user - including a low-privilege subscriber - to run arbitrary PHP on the server because the plugin's debugging console, which evaluates user-supplied PHP, is not access-restricted. Publicly available exploit code exists (reported by WPScan), and with CVSS 9.9 this represents full server compromise from the lowest authenticated role. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Persist

technique details hidden

Impact

technique details hidden

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Persist

technique details hidden

Impact

technique details hidden

Vulnerability AssessmentAI

Exploitation	Exploitation requires (1) a WordPress site with the WatchMan-Site7 plugin ≤4.2.0 installed and active, and (2) any authenticated account at minimum subscriber level - the flaw is reachable specifically through the plugin's debugging console feature, which executes user-supplied PHP without an access-control/capability check. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	All signals align toward high priority: the CVSS 3.1 base is 9.9 with AV:N (network), AC:L (low complexity), PR:L (only a low-privilege account needed), UI:N (no user interaction), and full C:H/I:H/A:H impact, and publicly available exploit code exists per WPScan. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation	No vendor-released patched version is identified in the input data, so treat this as unpatched: the safest action is to deactivate and remove the WatchMan-Site7 plugin until a fixed release above 4.2.0 is confirmed by the maintainer, since the vulnerable feature is the plugin's own debugging console. … Detailed patch versions, workarounds, and compensating controls in full report.