CVE-2026-66458

The RealPress plugin versions up to 1.1.2 contain an unauthenticated SQL Injection vulnerability. An attacker without logging in can send specially crafted queries that can manipulate the database.

An attacker can read, modify, or delete data from the database, potentially leading to confidentiality, integrity, and availability breaches. This may also enable takeover of administrator accounts or the entire site.

Update the RealPress plugin to the latest version that includes the fix. If not available, immediately restrict access to the plugin and monitor database logs for suspicious queries.