CVE-2026-77009

WatchMan-Site7, a WordPress site-monitoring plugin, exposes a debugging console through version 4.2.0 that is not access-restricted and executes user-supplied PHP code. Any authenticated account, even a low-privileged subscriber, can reach the console over the network and have arbitrary PHP executed on the web server. Successful exploitation yields full remote code execution with high impact to confidentiality, integrity, and availability, potentially compromising the entire site and its hosting environment (the CVSS score reflects scope change beyond the plugin). Any WordPress installation running WatchMan-Site7 4.2.0 or earlier is affected, with elevated risk on sites that allow open registration, since attackers can self-register as subscribers. No public proof-of-concept, CISA KEV listing, or confirmed exploitation is known, and the EPSS score (0.3%, 21st percentile) indicates a low probability of exploitation in the next 30 days.

What to do: Update WatchMan-Site7 to the newest release above 4.2.0 as soon as a patched version is available on wordpress.org, or deactivate the plugin until then. As an interim measure, block or restrict access to the plugin's debugging console (e.g., via WAF rules) and review whether open registration allows strangers to obtain subscriber accounts. Check web-server and WordPress logs for unexplained PHP execution, modified files, or unusual authenticated requests to the console.