CVE-2026-6933 Overview
CVE-2026-6933 is a remote code execution vulnerability in the Premmerce Dev Tools plugin for WordPress, affecting all versions up to and including 2.0. The flaw stems from missing authorization in the generatePluginHandler function combined with unsanitized string substitution in the createFromStub function. Authenticated attackers with Subscriber-level access can inject arbitrary PHP code through the premmerce_plugin_namespace parameter, which is written directly into PHP stub files inside wp-content/plugins/. Accessing the generated plugin file over HTTP executes the injected code, granting full command execution on the web server. The vulnerability is classified under [CWE-434] Unrestricted Upload of File with Dangerous Type.
Critical Impact
Subscriber-level WordPress accounts can write arbitrary PHP files into the plugins directory and achieve remote code execution on the underlying host.
Affected Products
- Premmerce Dev Tools plugin for WordPress, versions up to and including 2.0
- WordPress sites with the plugin installed and active
- Any site allowing Subscriber-level (or higher) user registration with the plugin enabled
Discovery Timeline
- 2026-06-16 - CVE-2026-6933 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2026-6933
Vulnerability Analysis
The Premmerce Dev Tools plugin exposes an administrative plugin-scaffolding feature that generates new PHP plugin files from stub templates. The handler that creates these files does not verify the caller's role or capability, so any authenticated session — including a Subscriber — can invoke it. The handler reads attacker-controlled POST parameters and passes them, without sanitization, into a string-substitution routine that produces a PHP file under wp-content/plugins/. Because the generated file is a normal WordPress plugin file reachable over HTTP, PHP code embedded by the attacker runs in the web server context. The result is full remote code execution from a low-privileged account.
Root Cause
Two defects combine to produce the vulnerability. First, generatePluginHandler in src/Admin/Admin.php lacks any current_user_can or nonce-backed authorization check before processing user-supplied POST data. Second, createFromStub in src/PluginGenerator/PluginGenerator.php performs naive token replacement of the premmerce_plugin_namespace value into PHP stub content, with no validation that the string is a legal PHP namespace identifier. Together, these conditions break the trust boundary between input and generated source code, an [CWE-434] category weakness.
Attack Vector
An attacker registers or authenticates as a Subscriber, then issues a POST request to the plugin generator endpoint. By supplying a premmerce_plugin_namespace value containing a semicolon followed by PHP statements, the attacker terminates the intended namespace declaration in the stub and appends arbitrary code. The generator writes the file into wp-content/plugins/ under an attacker-influenced path. Sending an HTTP request to that file executes the injected PHP, enabling command execution, credential theft, or persistence as a webshell.
No verified public proof-of-concept code is available. See the WordPress Plugin Admin Source and WordPress Plugin Generator Source for the vulnerable code paths.
Detection Methods for CVE-2026-6933
Indicators of Compromise
- New or unexpected PHP files appearing under wp-content/plugins/ with recent modification timestamps and unusual namespace declarations.
- PHP files containing semicolons or executable statements embedded inside namespace declarations near the top of the file.
- POST requests to the Premmerce Dev Tools plugin generator endpoint originating from low-privileged user sessions.
- Outbound network connections from the PHP-FPM or web server process to unfamiliar hosts shortly after plugin file creation.
Detection Strategies
- Monitor file integrity in wp-content/plugins/ and alert on file creation by the web server user outside scheduled update windows.
- Inspect WordPress access logs for POST traffic to the plugin admin handler from accounts that do not normally use admin features.
- Hunt for PHP process executions spawning sh, bash, curl, wget, or python from the web server parent process.
Monitoring Recommendations
- Centralize WordPress, PHP, and web server logs and correlate authentication events with subsequent file system writes.
- Enable WordPress audit logging for plugin and file management actions, including the originating user and IP.
- Baseline the contents of wp-content/plugins/ and alert on any new top-level directory or file outside vendor update events.
How to Mitigate CVE-2026-6933
Immediate Actions Required
- Deactivate and remove the Premmerce Dev Tools plugin on any WordPress site running version 2.0 or earlier until a patched release is installed.
- Disable open user registration or restrict the Subscriber role on internet-facing WordPress instances where the plugin must remain active.
- Audit wp-content/plugins/ for unexpected files and review WordPress user accounts created in the affected window.
- Rotate WordPress administrator credentials, API keys, and database secrets if compromise is suspected.
Patch Information
No fixed version is listed in the NVD entry at publication. Consult the Wordfence Vulnerability Intelligence advisory and the Premmerce Dev Tools plugin page on WordPress.org for the latest patched release and upgrade guidance.
Workarounds
- Block requests to the plugin generator admin endpoint at a web application firewall until the plugin is patched or removed.
- Set the WordPress DISALLOW_FILE_MODS constant in wp-config.php to prevent plugin and theme writes from the web UI.
- Enforce file system permissions that prevent the web server user from creating new files inside wp-content/plugins/.
- Require multi-factor authentication for all WordPress accounts to reduce the risk of Subscriber account abuse.
# Configuration example: harden wp-config.php and plugin directory
# 1) Disable plugin/theme file modifications through the WordPress UI
echo "define('DISALLOW_FILE_MODS', true);" >> /var/www/html/wp-config.php
# 2) Restrict write access to the plugins directory
chown -R root:www-data /var/www/html/wp-content/plugins
find /var/www/html/wp-content/plugins -type d -exec chmod 755 {} \;
find /var/www/html/wp-content/plugins -type f -exec chmod 644 {} \;
# 3) Remove the vulnerable plugin until a fixed version is available
wp plugin deactivate premmerce-dev-tools --allow-root
wp plugin delete premmerce-dev-tools --allow-root
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
