Executive Summary

A critical vulnerability (CVE-2026-77009) with a CVSS score of 9.9 has been identified in the WatchMan-Site7 WordPress plugin through version 4.2.0. This vulnerability allows any authenticated user, including subscribers, to execute arbitrary PHP code on the server due to unrestricted access to the debugging console. The vulnerability is not currently being actively exploited but poses a significant risk due to its severity and exploitability.

Technical Analysis

The vulnerability is classified as CWE-94, which involves the improper control of name resolution. The WatchMan-Site7 plugin does not restrict access to its debugging console, which executes user-supplied PHP code. An attacker can leverage this by sending a crafted request to the debugging console, allowing them to run arbitrary PHP code on the server.

How It Gets Exploited

An attacker with authenticated access to the WordPress site, even at a low privilege level such as a subscriber, can exploit this vulnerability. The attacker would navigate to the debugging console of the WatchMan-Site7 plugin and supply malicious PHP code. When executed, this code allows the attacker to achieve arbitrary code execution on the server, potentially leading to a complete compromise of the server and the ability to pivot to other parts of the network.

Impact Assessment

The vulnerability affects all versions of the WatchMan-Site7 plugin up to and including 4.2.0. The impact is severe, with an attacker able to achieve arbitrary code execution, data exfiltration, and potentially escalate privileges. The CVSS score of 9.9 reflects the critical nature of this vulnerability, with high impacts on confidentiality, integrity, and availability.

Recommended Actions

To mitigate this vulnerability, it is recommended to update the WatchMan-Site7 plugin to a version greater than 4.2.0 as soon as possible. Additionally, users should ensure that only trusted and authenticated users have access to the WordPress site, and consider implementing additional security measures such as web application firewalls (WAFs) to detect and prevent exploitation attempts.

Sources