Arbitrary file upload in Premmerce Dev Tools

CVE-2026-6933

The Premmerce Dev Tools plugin for WordPress is vulnerable to Remote Code Execution via missing authorization in versions up to and including 2.0. This is due to the 'generatePluginHandler' function lacking any authorization check before processing user-supplied POST data, combined with the 'createFromStub' function performing unsanitized string substitution of the 'premmerce_plugin_namespace' parameter directly into PHP stub files written to the wp-content/plugins/ directory. An attacker can inject a semicolon followed by arbitrary PHP code into the namespace parameter, causing the generated plugin file to contain and execute that code when accessed via HTTP. This makes it possible for authenticated attackers with Subscriber-level access and above to create arbitrary PHP files on the server and achieve remote code execution.

Vulnerability class: Unrestricted File Upload

Published · last modified .

CVSS v3 metric

CVSS v3 base score 8.8 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.

EPSS exploit prediction

EPSS: 0.011 (62.9th percentile), scored .

Low probability of exploitation in the next 30 days, but still tracked. 63rd percentile — 62.9% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.

EPSS trend (30 days)EPSS over the last 30 days for CVE-2026-6933: held from 0.008 to 0.011.

EPSS over last 30 days · oldest: 0.008 · newest: 0.011 · change: +0.002

Affected products

Weakness classification (CWE)

References

Frequently asked questions

What is CVE-2026-6933?
CVE-2026-6933 is a high-severity vulnerability in Premmerce Dev Tools, classified under Unrestricted Upload of File with Dangerous Type. CVSS score: 8.8/10. Published 2026-06-16.
How severe is CVE-2026-6933?
High severity. CVSS v3 base score is 8.8 out of 10.