Monitor vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.9
CVE-2026-77009: WatchMan‑Site7 plugin lets logged‑in users run code on server
CVE-2026-77009 · published 1 day ago
Summary
The WatchMan‑Site7 add‑on for WordPress (versions 3.1.1 through 4.2.0) leaves its debug console open to anyone with a basic account. That means a regular user can enter code that the server will execute, potentially giving them control of the site. Update the plugin to a new version or remove it if you don’t need the debugging feature, and restrict access to trusted administrators only.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| unknown | watchman-site7 | <= 4.2.0 |
Original advisory text
WatchMan-Site7 3.1.1 - 4.2.0 - Subscriber+ RCE via Debug Console
The WatchMan-Site7 WordPress plugin through 4.2.0 does not restrict access to its debugging console, which executes user-supplied PHP code, allowing any authenticated user, such as a subscriber, to run arbitrary code on the server.
References
- https://wpscan.com/vulnerability/2881cd28-6c30-4942-9443-317dd19f1e4a/ exploit vdb-entry technical-description
Severity
9.9
Critical
CVSS 3.1: 9.9 (MITRE)
Type
CWE-94Code Injection
Timeline
Published2 Sep 2026
Updated2 Sep 2026
First seen2 Sep 2026
Monitor software like this
Free during beta