CVE-2026-61685
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk43th percentile - higher than 43% of all known CVEs
Summary
ReactPress is a publishing system for React developers. Prior to version 3.7.0, ReactPress API list endpoints build TypeORM `QueryBuilder` conditions using unsanitized HTTP query parameter names as SQL column identifiers (e.g. `` `article.${key}` ``). TypeORM parameterizes values but not column names, allowing unauthenticated attackers to inject SQL through crafted query string keys. Version 3.7.0 contains a patch. As a workaround, allowlist allowed filter column names before interpolating into SQL.
Risk Assessment
An unauthenticated attacker can inject SQL, potentially leading to unauthorized access or modification of data. The vulnerability affects public API endpoints, increasing the risk.
Recommendation
Upgrade ReactPress to version 3.7.0 or later. If not possible, apply the workaround of allowlisting allowed filter column names.
Other vulnerabilities in ReactPress
See all- CVE-2026-92712Medium
The ReactPress – Create React App for WordPress plugin is vulnerable to Stored Cross-Site Scripting via the 'permalink' parameter in all versions up to and including 3.4.0 due to insufficient input sanitization and output escaping. This allows authenticated attackers with subscriber-level access and above to inject arbitrary web scripts that execute when a user accesses an injected page. This is possible because the permalink parameter is only passed through sanitize_url(), which does not prevent fetching attacker-controlled remote URLs whose response body is written verbatim to disk via file_put_contents().
- CVE-2026-66455Medium
Broken Access Control vulnerability in ReactPress versions up to 3.4.0, exploitable by a user with Subscriber role.
Original NVD description (English source)
ReactPress is a publishing system for React developers. Prior to version 3.7.0, ReactPress API list endpoints build TypeORM `QueryBuilder` conditions using unsanitized HTTP query parameter names as SQL column identifiers (e.g. `` `article.${key}` ``). TypeORM parameterizes values but not column names, allowing unauthenticated attackers to inject SQL through crafted query string keys. Version 3.7.0 contains a patch. As a workaround, allowlist allowed filter column names before interpolating into SQL.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS