CVE-2026-110887
9.9CriticalPublished 19 Oct 2026 · NVD status: Received · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
- Impact
- Full C/I/A compromise
- Weakness
- CWE-94
Impact
Authenticated attackers can execute arbitrary code on the server via remote code inclusion. They need network access to the site and low-privilege user credentials.
Root cause
Improper input sanitization allows the plugin to include and execute remote code files.
Affected systems
HivePress WordPress plugin through 1.7.32
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Fix & remediation
Upgrade HivePress to a version newer than 1.7.32. If a patch is unavailable, deactivate and disable the HivePress plugin immediately.
$ wp plugin update hivepressAI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
Improper Control of Generation of Code ('Code Injection') vulnerability in HivePress HivePress hivepress allows Remote Code Inclusion.This issue affects HivePress: from n/a through 1.7.32.