Skip to main content

Watchman Site7

1 CVEs product

Monthly

CVE-2026-77009 Sep 02, 14:16 CRITICAL POC Act Now

Remote code execution in the WatchMan-Site7 WordPress plugin (all versions through 4.2.0) allows any authenticated user - including a low-privilege subscriber - to run arbitrary PHP on the server because the plugin's debugging console, which evaluates user-supplied PHP, is not access-restricted. Publicly available exploit code exists (reported by WPScan), and with CVSS 9.9 this represents full server compromise from the lowest authenticated role. There is no public evidence of active in-the-wild exploitation at time of analysis.

PHP WordPress RCE Code Injection Watchman Site7 +1
NVD WPScan
CVSS 3.1
9.9
EPSS
0.3%
EPSS 0% CVSS 9.9
CRITICAL POC Act Now

Remote code execution in the WatchMan-Site7 WordPress plugin (all versions through 4.2.0) allows any authenticated user - including a low-privilege subscriber - to run arbitrary PHP on the server because the plugin's debugging console, which evaluates user-supplied PHP, is not access-restricted. Publicly available exploit code exists (reported by WPScan), and with CVSS 9.9 this represents full server compromise from the lowest authenticated role. There is no public evidence of active in-the-wild exploitation at time of analysis.

PHP WordPress RCE +3
NVD WPScan

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy