CVE-2026-6933Disclosure

LOWCVSS 8.8 · HIGH

Exploit discussion active in current signal (2 latest mentions)

Immediate actions

Patch affected systems immediately
Hunt for exploitation attempts and persistence artifacts
Increase monitoring for publicly documented tradecraft

Recommended action window: High priority (within 72h)

NVD description

The Premmerce Dev Tools plugin for WordPress is vulnerable to Remote Code Execution via missing authorization in versions up to and including 2.0. This is due to the 'generatePluginHandler' function lacking any authorization check before processing user-supplied POST data, combined with the 'createFromStub' function performing unsanitized string substitution of the 'premmerce_plugin_namespace' parameter directly into PHP stub files written to the wp-content/plugins/ directory. An attacker can inject a semicolon followed by arbitrary PHP code into the namespace parameter, causing the generated plugin file to contain and execute that code when accessed via HTTP. This makes it possible for authenticated attackers with Subscriber-level access and above to create arbitrary PHP files on the server and achieve remote code execution.

Back to dashboard

2.0/ 10 priority

Sources & remediation

Other references

Weakness type (CWE)

CWE-434

Priority

LOW

Exploitation

NONE

PoC

YES

Patch

AVAILABLE

Momentum

NONE

Threat summary

Public PoC is present in monitored signal
Patch or workaround signal is available
2 mentions across 1 observed day

What's happening

PoC mentioned or linked in 1 signal
Patch or workaround mentioned in 1 signal
Technical details provided in 2 signals
Disclosure: 1 classified signal
2 total mentions across 1 day

Deep dive

Activity timeline2 mentions / 1d

Signal classification2 categories

Disclosure

150.0%

PoC

150.0%

Referenced assets2 URLs

By indicator

Full discourse2 posts

Hugo | DevOps | Cybersecurity 🇱🇻@HugoValters138d
PoC
#CVE-2026-6933 - Critical RCE in Premmerce Dev Tools #WordPress plugin. No auth required, allows arbitrary #PHP code injection. #CVSS 8.8. No patch available. Disable immediately. #infosec #cybersecurity #developers #devsecops #devops More information: https://www.valtersit.com/cve/CVE-2026-6933
Post summary
CVE‑2026‑6933 is a critical remote code execution flaw in the Premmerce Dev Tools WordPress plugin that allows unauthenticated PHP code injection, with no patch available; readers are urged to disable the plugin immediately.
0000049
932 followersView on X
Vulmon Vulnerability Feed@VulmonFeeds138d
Disclosure
CVE-2026-6933 Remote Code Execution in Premmerce Dev Tools Plugin for WordPress Up to 2.0 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-6933
Post summary
The announcement identifies a Remote Code Execution vulnerability (CVE-2026-6933) affecting Premmerce Dev Tools Plugin for WordPress versions up to 2.0, but contains no PoC, exploit code, or patch information.
0000054
4.0K followersView on X

Explore more

Back to dashboard