CVE-2026-77009: WatchMan-Site7 WordPress Plugin RCE Flaw

CVE-2026-77009 Overview

The WatchMan-Site7 WordPress plugin through version 4.2.0 exposes an unrestricted debugging console that executes user-supplied PHP code. Any authenticated user, including low-privilege subscribers, can invoke the console to run arbitrary code on the underlying server. The flaw is tracked as CWE-94: Improper Control of Generation of Code and stems from missing access controls on a developer-facing feature shipped in production builds.

Critical Impact
A subscriber-level account is sufficient to achieve remote code execution on WordPress sites running WatchMan-Site7 through 4.2.0, leading to full site and server compromise.

Affected Products

WatchMan-Site7 WordPress plugin, all versions through 4.2.0
WordPress sites that allow user registration or otherwise provision subscriber accounts
Hosting environments running the vulnerable plugin with PHP execution enabled

Discovery Timeline

2026-09-02 - CVE-2026-77009 published to NVD
2026-09-02 - Last updated in NVD database

Technical Details for CVE-2026-77009

Vulnerability Analysis

WatchMan-Site7 ships a debugging console intended for developer use. The console endpoint accepts arbitrary PHP source from the request and passes it to a dynamic evaluation routine. The plugin does not verify that the calling user holds a privileged capability such as manage_options, so any authenticated WordPress role can reach the handler.

Because WordPress commonly grants subscriber accounts to visitors through open registration or membership flows, the effective barrier is a valid session cookie. Once code executes, an attacker inherits the privileges of the web server user. That access enables webshell installation, database exfiltration, credential theft from wp-config.php, and lateral movement into adjacent workloads.

Root Cause

The root cause is improper control of code generation combined with broken access control on the debug handler. The plugin exposes a PHP evaluation primitive to authenticated requests without a capability check, nonce validation, or environment gate that would restrict the feature to development builds.

Attack Vector

An attacker registers or acquires a subscriber account on the target WordPress site. The attacker then sends an authenticated HTTP request to the plugin's debug console endpoint with PHP payload data. The server evaluates the payload in-process and returns the result. See the WPScan Vulnerability Report for technical details.

Detection Methods for CVE-2026-77009

Indicators of Compromise

Unexpected PHP files written under wp-content/uploads/ or plugin directories after requests to WatchMan-Site7 endpoints
Outbound connections from the WordPress host to attacker-controlled infrastructure shortly after authenticated POSTs to the plugin
New or modified WordPress administrator accounts created without a corresponding audit trail
Web server processes spawning shell interpreters such as sh, bash, or /usr/bin/python

Detection Strategies

Alert on HTTP requests to WatchMan-Site7 debug or console routes that contain PHP tokens such as <?php, eval(, system(, or base64_decode(
Correlate subscriber-role authentication events with subsequent process execution on the web host
Monitor file integrity on WordPress plugin and upload directories for unauthorized writes

Monitoring Recommendations

Ingest WordPress access logs and PHP-FPM logs into a centralized analytics platform and retain them for post-incident review
Track child processes of the web server user and flag interactive shells or network utilities
Review WordPress user registrations and role changes on a recurring cadence

How to Mitigate CVE-2026-77009

Immediate Actions Required

Deactivate and remove the WatchMan-Site7 plugin on any site running version 4.2.0 or earlier until a fixed release is verified
Disable open user registration or restrict the default role to prevent unauthenticated subscriber provisioning
Rotate WordPress administrator passwords, secret keys in wp-config.php, and any credentials reachable from the web host
Audit installed plugins, themes, scheduled tasks, and administrative users for unauthorized changes

Patch Information

No fixed version is referenced in the current advisory. Consult the WPScan Vulnerability Report for the latest vendor status and remove the plugin until a patched release is confirmed.

Workarounds

Block requests to the plugin's debug console path at the web application firewall or reverse proxy
Restrict PHP disable_functions to remove eval, assert, system, exec, shell_exec, passthru, and proc_open where application compatibility allows
Enforce least privilege on the web server user and mount plugin and upload directories as non-executable where feasible

bash

# Example: block WatchMan-Site7 plugin endpoints at nginx until removal is complete
location ~* /wp-content/plugins/watchman-site7/ {
    deny all;
    return 403;
}