CVE-2026-110887: WordPress HivePress plugin <= 1.7.32 - Remote Code Execution (RCE) vulnerability
Improper Control of Generation of Code ('Code Injection') vulnerability in HivePress HivePress hivepress allows Remote Code Inclusion.This issue affects HivePress: from n/a through 1.7.32.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
wordpress/hivepressto a version that resolves this vulnerability.Fixed in 1.8.0
Event History
Frequently Asked Questions
Which installations are affected?
HivePress versions through 1.7.32 are affected. The available data does not identify a fixed version or any unaffected configuration.
What level of access does an attacker need?
The CVSS vector indicates that an attacker needs low privileges and can exploit the issue over the network without user interaction. The vulnerability has a low attack complexity.
What is the potential impact of successful exploitation?
Successful exploitation can result in remote code execution through remote code inclusion. The CVSS vector indicates high impacts to confidentiality, integrity, and availability, with scope changed.