A critical code injection vulnerability in the WatchMan-Site7 WordPress plugin allows authenticated users to achieve full remote code execution on the host server.

The plugin fails to perform adequate capability checks on its debugging console, which permits any authenticated user, including those with minimal subscriber-level privileges, to inject and execute arbitrary PHP code. This vulnerability is classified as CWE-94, Improper Control of Generation of Code.

Successful exploitation of this flaw grants an attacker full control over the compromised WordPress instance and the underlying server environment. Given the CVSS score of 9.9, the impact is severe, potentially leading to total data exfiltration, complete system compromise, and the deployment of persistent backdoors or ransomware.

Immediate Action: As no specific patched version is currently identified, administrators should immediately deactivate and uninstall the WatchMan-Site7 plugin until a security update is released by the vendor.

Proactive Monitoring: Review web server access logs for unusual POST requests directed at plugin-specific debugging endpoints or suspicious PHP execution patterns.

Compensating Controls: Deploy a Web Application Firewall (WAF) with custom rules designed to block unauthorized access to debugging consoles and detect common PHP injection payloads.

Public Exploit Available: Unknown.

Due to the critical severity and the potential for total system compromise, immediate removal of the affected plugin is the only effective way to eliminate this risk. IT teams should verify the presence of the plugin across all managed WordPress environments and prioritize its removal until the developer provides a verified security patch.