CVE-2026-66630: WordPress PublishPress Series plugin <= 3.1.3 - SQL Injection vulnerability

Q: What level of access is required to exploit this issue?

An attacker needs high privileges, consistent with administrator-level access. The attack is network-reachable, has low complexity, and does not require user interaction.

Q: What is the likely security impact if exploitation succeeds?

The vulnerability is rated as having high confidentiality impact and low availability impact. It has no listed integrity impact, while the scope is marked as changed.

Published Sep 17, 2026

Updated

Administrator SQL Injection in PublishPress Series <= 3.1.3 versions.

Affected Software

1 affected component

WordPress PublishPress Series<=3.1.3

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade WordPress PublishPress Series plugin to a version that resolves this vulnerability.
Fixed in 3.1.4

Event History

Sep 17, 2026

CVE Published

via MITRE·01:24 PM

Data Sourced

via MITRE·01:24 PM

RemedyDescriptionSeverityWeakness

Frequently Asked Questions

What level of access is required to exploit this issue?

An attacker needs high privileges, consistent with administrator-level access. The attack is network-reachable, has low complexity, and does not require user interaction.

What is the likely security impact if exploitation succeeds?