CVE-2026-6933: Premmerce Dev Tools <= 2.0 - Missing Authorization to Authenticated (Subscriber+) Remote Code Execution via Plugin Creation

Synopsis

A missing authorization and unsanitized input vulnerability in the Premmerce Dev Tools plugin for WordPress (versions up to and including 2.0) allows any authenticated user with Subscriber-level access to achieve remote code execution. The attack reaches the vulnerable endpoint over the network by sending a crafted POST request with a malicious namespace parameter, which gets written verbatim into a PHP file on the server. Successful exploitation gives the attacker full control over the server, including reading all data, modifying files, and disrupting services. HarborGuard is tracking the advisory for patch availability, as no fix version has been published.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the WordPress site's HTTP endpoint over the network to send the malicious POST request to the vulnerable handler.

• AuthenticationRequired

  A valid WordPress account is required, though any low-privilege Subscriber-level account is sufficient; no administrator credentials are needed.

• Victim interactionNot required

  The attacker does not need any action from another user; the exploit is fully self-contained once the attacker submits the crafted request.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and requires no special conditions, race timing, or knowledge of memory layout.

Blast Radius

• The attacker writes arbitrary PHP files into the wp-content/plugins/ directory and executes server-side code by accessing those files over HTTP.
• All data stored on the WordPress installation, including user credentials, session tokens, and customer records, is readable by the attacker.
• The attacker can modify or delete any file the web server process has write access to, including WordPress core files, themes, and other plugins.
• The attacker can crash or destabilize the web server process, taking the site offline or making it unresponsive.