CVE-2026-77009
Received Received - Intake

Unauthenticated PHP Code Execution in WatchMan-Site7 WordPress Plugin

Publication date: 2026-09-02

Last updated on: 2026-09-02

Assigner: WPScan

Description
The WatchMan-Site7 WordPress plugin through 4.2.0 does not restrict access to its debugging console, which executes user-supplied PHP code, allowing any authenticated user, such as a subscriber, to run arbitrary code on the server.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-02
Last Modified
2026-09-02
Generated
2026-09-02
AI Q&A
2026-09-02
EPSS Evaluated
N/A
NVD
CVE-2026-77009
EUVD
EUVD-2026-70039

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
watchman_site7 watchman_site7 4.2.0
watchman_site7 watchman_site7 From 3.1.1 (inc) to 4.2.0 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-94 The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The WatchMan-Site7 WordPress plugin through version 4.2.0 has a critical vulnerability where its debugging console does not restrict access. This console allows any authenticated user, including low-privilege users like subscribers, to execute arbitrary PHP code on the server. The plugin has been removed from the WordPress repository and no fixes will be released.

Detection Guidance

Check if the WatchMan-Site7 plugin versions 3.1.1 to 4.2.0 is installed on your WordPress site. You can use commands like 'wp plugin list' in the WordPress directory or inspect the plugin files in /wp-content/plugins/watchman-site7/. Look for the presence of the debugging console feature.

Impact Analysis

This vulnerability allows attackers with even minimal access to take full control of your WordPress server. They can execute malicious code, steal sensitive data, install backdoors, or disrupt services. The impact includes complete system compromise and potential data breaches.

Compliance Impact

This vulnerability likely violates compliance requirements for GDPR and HIPAA due to unauthorized code execution and potential data exposure. It enables attackers to access, modify, or exfiltrate sensitive data, leading to regulatory penalties and loss of trust.

Mitigation Strategies

Immediately deactivate and delete the WatchMan-Site7 plugin from your WordPress installation. Since no fixes will be released and the plugin is removed from the repository, removal is the only mitigation option.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-77009. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart