Executive brief
The Premmerce Dev Tools plugin for WordPress, used by developers to streamline plugin creation, contains a security flaw that allows users with basic account access to take over the website. By sending a specially crafted request, an attacker can force the website to create and run malicious code. This could lead to a total compromise of the server, theft of customer data, or complete website downtime.
Technical details
The vulnerability exists in the 'generatePluginHandler' function of the Premmerce Dev Tools plugin due to a lack of authorization checks on POST data. This is compounded by the 'createFromStub' function, which performs unsanitized string substitution of the 'premmerce_plugin_namespace' parameter into PHP stub files. An attacker with Subscriber-level permissions or higher can inject a semicolon and arbitrary PHP code into this parameter. The plugin then writes this malicious code into a new PHP file within the wp-content/plugins/ directory, which can be executed by accessing the file via HTTP. This results in full remote code execution (RCE).
Affected products
- Premmerce Premmerce Dev Tools up to and including 2.0
Timeline
- 2026-06-16: disclosed
- 2026-06-16: advisory
References
- https://plugins.trac.wordpress.org/browser/premmerce-dev-tools/tags/2.0/src/Admin/Admin.php
- https://plugins.trac.wordpress.org/browser/premmerce-dev-tools/tags/2.0/src/PluginGenerator/PluginData.php
- https://plugins.trac.wordpress.org/browser/premmerce-dev-tools/tags/2.0/src/PluginGenerator/PluginGenerator.php
- https://plugins.trac.wordpress.org/browser/premmerce-dev-tools/trunk/src/Admin/Admin.php
- https://plugins.trac.wordpress.org/browser/premmerce-dev-tools/trunk/src/PluginGenerator/PluginData.php
- https://plugins.trac.wordpress.org/browser/premmerce-dev-tools/trunk/src/PluginGenerator/PluginGenerator.php
- https://www.wordfence.com/threat-intel/vulnerabilities/id/c43c060b-7a18-49ee-a753-ae1ed2f7e04d?source=cve