CVE-2026-110885: WordPress HivePress plugin <= 1.7.32 - Content Injection vulnerability
Published Oct 18, 2026
·Updated
Improper Control of Generation of Code ('Code Injection') vulnerability in HivePress HivePress hivepress allows Code Injection.This issue affects HivePress: from n/a through 1.7.32.
Affected Software
1 affected component
HivePress HivePress<=1.7.32
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WordPress HivePress pluginto a version that resolves this vulnerability.Fixed in 1.8.0
Event History
Oct 18, 2026
CVE Published
via MITRE·11:00 AM
Data Sourced
via MITRE·11:00 AM
RemedyDescriptionSeverityWeakness
Data Sourced
via NVD·11:16 AM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Does exploitation require an authenticated account?
Yes. The attack vector indicates low privileges are required (PR:L), so an attacker needs an account or access level with limited permissions.
2
Does an attacker need a victim to take any action?
No. User interaction is not required (UI:N), and the issue is remotely reachable over the network (AV:N).
3
What is the expected security impact if exploited?
The stated impact is high confidentiality impact (C:H). Integrity and availability impacts are listed as none (I:N and A:N).