CVE-2026-110887
CriticalCVSS 9.9Summary
The HivePress plugin through 1.7.32 contains a code injection vulnerability due to improper control of code generation. This allows remote code inclusion into the application.
Risk Assessment
An attacker may inject and execute their own code in the context of the WordPress application, potentially leading to server takeover. This requires interaction with the vulnerable plugin mechanism.
Recommendation
Update the HivePress plugin to a version later than 1.7.32. Review logs for unusual requests and inspect plugin files for unauthorized changes.
Other vulnerabilities in HivePress
See all- CVE-2026-110885Medium
The HivePress plugin for WordPress (up to version 1.7.32) has a Code Injection vulnerability due to improper control of code generation. An attacker can inject and execute arbitrary code in the application context.
- CVE-2026-103520Medium
The HivePress plugin for WordPress up to version 1.7.31 is vulnerable to stored XSS via the 'custom text attribute' parameter. Exploitation requires an administrator to configure a Text attribute with a display format placing %value% inside an HTML attribute.
Original NVD description (English source)
Improper Control of Generation of Code ('Code Injection') vulnerability in HivePress HivePress hivepress allows Remote Code Inclusion.This issue affects HivePress: from n/a through 1.7.32.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS