What is GHSA-j83j-cm7x-4gpc?

GHSA-j83j-cm7x-4gpc is a security advisory published by GitHub Security Advisories with Critical severity. The WatchMan-Site7 WordPress plugin through 4.2.0 does not restrict access to its debugging...

Which CVE IDs does GHSA-j83j-cm7x-4gpc cover?

GHSA-j83j-cm7x-4gpc covers the following CVE IDs: CVE-2026-77009. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-j83j-cm7x-4gpc?

GHSA-j83j-cm7x-4gpc has a CVSS v3 base score of 9.9, published by GitHub Security Advisories.

GHSA-j83j-cm7x-4gpcCriticalCVSS 9.9

The WatchMan-Site7 WordPress plugin through 4.2.0 does not restrict access to its debugging...

Vendor

GitHub Security Advisories

Published

September 2, 2026

Last Modified

September 2, 2026

🔗 CVE IDs covered (1)

CVE-2026-77009 →

📋 Description

The WatchMan-Site7 WordPress plugin through 4.2.0 does not restrict access to its debugging console, which executes user-supplied PHP code, allowing any authenticated user, such as a subscriber, to run arbitrary code on the server.

🔗 References (3)

https://nvd.nist.gov/vuln/detail/CVE-2026-77009
https://wpscan.com/vulnerability/2881cd28-6c30-4942-9443-317dd19f1e4a
https://github.com/advisories/GHSA-j83j-cm7x-4gpc