CVE-2026-6933 is a high-severity vulnerability in the Premmerce Dev Tools WordPress plugin (up to and including version 2.0). The vulnerability arises from missing authorization checks in the 'generatePluginHandler' function, which processes user-supplied POST data without validation. Additionally, the 'createFromStub' function performs unsanitized string substitution of the 'premmerce_plugin_namespace' parameter directly into PHP stub files saved in the wp-content/plugins/ directory. This allows an attacker with at least Subscriber-level privileges to inject a semicolon and arbitrary PHP code into the namespace parameter, resulting in the creation of malicious PHP files that execute when accessed via HTTP, enabling remote code execution on the server.

An attacker with authenticated access at Subscriber level or higher can create arbitrary PHP files on the server by exploiting the lack of authorization and input sanitization. This leads to remote code execution, compromising confidentiality, integrity, and availability of the affected system. The vulnerability has a CVSS 3.1 base score of 8.8, indicating high severity with network attack vector, low attack complexity, and no user interaction required.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to trusted users only and consider disabling or removing the Premmerce Dev Tools plugin if possible. Monitor for updates from the vendor and apply patches promptly once released.