CVE-2026-6933: Unauthenticated RCE in Premmerce Dev Tools WordPress Plugin

Overview

CVE-2026-6933 is a high-severity remote code execution (RCE) vulnerability in the Premmerce Dev Tools plugin for WordPress. Versions up to and including 2.0 are affected. With a CVSS score of 8.8 (High), the flaw allows attackers with network access to execute arbitrary code on the server by exploiting a missing authorization check in the plugin's generatePluginHandler function.

Technical Details

The vulnerability stems from the generatePluginHandler function, which processes user-supplied POST data to dynamically generate plugin structures without performing any authorization verification. By combining this missing check with the createF file-creation capability exposed by the handler, an unauthenticated (or low-privilege) attacker can write arbitrary PHP content to the server's filesystem and trigger its execution.

Attack vector: Network
Attack complexity: Low
Privileges required: None (or low in some configurations)
User interaction: None
Scope: Changed
Confidentiality / Integrity / Availability: High / High / High

The combination of missing authorization and file-write capability creates a straightforward path to full server compromise. An attacker can upload a web shell or directly write malicious PHP code, then request it through a browser to achieve RCE.

Exploitation Path

1. Attacker sends a crafted POST request to the generatePluginHandler endpoint with arbitrary PHP payload in the body — no authentication cookie required.
2. The handler writes the supplied content to a PHP file on disk via the createF function.
3. Attacker sends a GET request to the newly created file to execute arbitrary PHP code with the web server's privileges.
4. Full server access is achieved — credential harvesting, persistence installation, lateral movement.

Impact

Successful exploitation grants an attacker:

• Arbitrary code execution under the web server user context (www-data, apache, etc.)
• Ability to read all files accessible to the web server, including wp-config.php and database credentials
• Ability to install persistent backdoors or web shells
• Potential for lateral movement to other services on the same host

Affected Versions

Remediation

1. Update Premmerce Dev Tools to the latest patched version immediately.
2. If no patch is available, deactivate and remove the plugin until a fix is published.
3. Audit the WordPress uploads and plugin directories for any unexpected .php files that may have been written by an attacker.
4. Review server access logs for anomalous POST requests to WordPress admin AJAX or plugin handler endpoints.
5. Enforce a WAF rule blocking unauthenticated POST requests to sensitive WordPress endpoints.

Detection

Monitor for POST requests to WordPress endpoints containing PHP code patterns (<?php, eval(, base64_decode(). Check for new or modified PHP files in the WordPress installation directory tree that were not part of a legitimate plugin update.

References

• NVD Entry for CVE-2026-6933
• WordPress Plugin Repository — Premmerce Dev Tools