PT-2026-49618 · WordPress · Premmerce Dev Tools
CVSS v3.1
8.8
High
| Vector | AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
Premmerce Dev Tools versions prior to 2.1
Description
The Premmerce Dev Tools plugin for WordPress allows authenticated attackers with Subscriber-level access and above to achieve remote code execution. The issue occurs because the
generatePluginHandler() function does not perform authorization checks before processing user-supplied POST data. Additionally, the createFromStub() function performs unsanitized string substitution of the premmerce plugin namespace parameter into PHP stub files saved in the wp-content/plugins/ directory. An attacker can inject a semicolon and arbitrary PHP code into the premmerce plugin namespace parameter, resulting in the creation and execution of a malicious PHP file when accessed via HTTP.Recommendations
Update the plugin to a version later than 2.0.
As a temporary workaround, restrict access to the
generatePluginHandler() function to prevent unauthorized users from processing POST data.Fix
RCE
Unrestricted File Upload
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Premmerce Dev Tools