CVE-2026-110885
MediumCVSS 6.5Summary
The HivePress plugin for WordPress (up to version 1.7.32) has a Code Injection vulnerability due to improper control of code generation. An attacker can inject and execute arbitrary code in the application context.
Risk Assessment
This allows remote code execution, potentially leading to full server compromise, data theft, or backdoor installation. It is a critical vulnerability.
Recommendation
Immediately update the HivePress plugin to the latest version (above 1.7.32). If not possible, disable the plugin and perform a security audit.
Other vulnerabilities in HivePress
See all- CVE-2026-110887Critical
The HivePress plugin through 1.7.32 contains a code injection vulnerability due to improper control of code generation. This allows remote code inclusion into the application.
- CVE-2026-103520Medium
The HivePress plugin for WordPress up to version 1.7.31 is vulnerable to stored XSS via the 'custom text attribute' parameter. Exploitation requires an administrator to configure a Text attribute with a display format placing %value% inside an HTML attribute.
Original NVD description (English source)
Improper Control of Generation of Code ('Code Injection') vulnerability in HivePress HivePress hivepress allows Code Injection.This issue affects HivePress: from n/a through 1.7.32.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS