CVE-2026-77009
WatchMan-Site7 3.1.1 - 4.2.0 - Subscriber+ RCE via Debug Console
CVSS Score
9.9
EPSS Score
0.0%
EPSS Percentile
0th
The WatchMan-Site7 WordPress plugin through 4.2.0 does not restrict access to its debugging console, which executes user-supplied PHP code, allowing any authenticated user, such as a subscriber, to run arbitrary code on the server.
| Vendor | unknown |
| Product | watchman-site7 |
| Published | Sep 2, 2026 |
| Last Updated | Sep 2, 2026 |
Stay Ahead of the Next One
Get instant alerts for unknown watchman-site7
Be the first to know when new critical vulnerabilities affecting unknown watchman-site7 are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
Affected Versions
Unknown / WatchMan-Site7
3.1.1 ≤ 4.2.0
References
Credits
Daniel Dhaniswara WPScan