CVE-2026-6933

Vulnerability

The Premmerce Dev Tools plugin for WordPress, versions up to and including 2.0, contains a remote code execution vulnerability. The generatePluginHandler function, hooked via admin_post_create_plugin, lacks any authorization or nonce check before processing user-supplied POST data [3][4]. The subsequent createFromStub method performs unsanitized string substitution of the premmerce_plugin_namespace parameter directly into PHP stub files [1][2]. An attacker can inject a semicolon followed by arbitrary PHP code into the namespace parameter, which gets written into generated plugin files in wp-content/plugins/. Accessing that generated file executes the injected code.

Exploitation

The attacker needs only a WordPress account with Subscriber-level access or higher. The generatePluginHandler action is accessible via admin-post.php without checking the manage_options capability [3][4]. An authenticated attacker can craft a POST request to /wp-admin/admin-post.php?action=create_plugin containing the premmerce_plugin_namespace parameter with payload such as Vendor\;system($_GET['cmd']);?> and other required parameters. The plugin generator then creates a new plugin directory and writes PHP files containing the injected code. By making an HTTP request to the generated plugin’s endpoint (e.g., /wp-content/plugins//index.php), the attacker triggers PHP execution of their payload.

Impact

Successful exploitation allows the attacker to execute arbitrary PHP code on the server. This results in complete compromise of the WordPress site: the attacker can read, modify, or delete any files, access the database, escalate privileges, and persist access via the created plugin. The code runs in the context of the web server, with the same permissions as the WordPress installation.

Mitigation

As of the publication date, no fixed version has been released. The only mitigation is to immediately delete or deactivate the Premmerce Dev Tools plugin (versions 2.0 and earlier) as it is a development utility that should not be used on production sites. Site administrators should review all users with Subscriber roles and ensure no untrusted users have accounts if the plugin must remain temporarily active. No workaround short of removing the plugin is available.