EUVD-2026-103421
GHSA-m58g-g98h-p79w
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate as low-privilege WordPress user
-
ExploitSubmit crafted input to HivePress feature
-
ExecutionTrigger improper code/content injection (CWE-94)
-
ImpactDisclose sensitive data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Code injection prevention, sandbox exec
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires an authenticated account with at least low privileges (CVSS PR:L) on a WordPress site running the HivePress plugin version 1.7.32 or earlier; exploitation is network-reachable with low complexity and no user interaction. The key limiting factor is the authentication requirement - an attacker must first obtain a valid (even low-privilege) account, so this is not exploitable by fully unauthenticated visitors. The specific injectable feature, endpoint, or configuration is not named in the available data and should be confirmed from the Patchstack advisory; the reported impact is limited to confidentiality (no integrity or availability impact per the vector). |
| Impact | Moderate priority. The provided CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, base 6.5) describes a network-reachable, low-complexity flaw requiring low-privilege authentication (PR:L) with no user interaction, but - notably for a CWE-94 'Code Injection' issue - it claims only confidentiality impact (C:H) and explicitly no integrity or availability impact (I:N/A:N). This is internally inconsistent: genuine code injection/RCE almost always carries high integrity and availability impact, yet the Patchstack reference title describes it as a 'content injection vulnerability,' which aligns far better with the C-only impact than with the 'RCE' tag. This discrepancy should be verified with the vendor/Patchstack before treating it as true remote code execution. On exploitation signals: there is no CISA KEV listing, no EPSS score supplied, and no public exploit referenced in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation. Net read: a real but not emergency-grade issue - authenticated (low-privilege) access is required, which meaningfully limits mass exploitation, and the true technical impact appears to be information disclosure/content injection rather than full server compromise. Patch by updating past 1.7.32, but it does not warrant drop-everything urgency absent exploitation data. |
| Exploit ScenarioDerived | A low-privileged authenticated user (e.g., a registered site member or contributor on a WordPress site running HivePress ≤1.7.32) submits crafted input into an injectable field, causing the plugin to improperly process attacker-controlled code/content. Per the CVSS vector this yields high confidentiality impact (data exposure) without reported integrity or availability effects. No public proof-of-concept is referenced in the provided data. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 18, 2026
Code injection (CWE-94) in the HivePress WordPress plugin, affecting versions through 1.7.32, allows an authenticated user holding only low privileges to influence the generation of executable code on the host site, with the assessed impact falling entirely on confidentiality. Exploitation is network-reachable at low complexity with no user interaction, but it is gated by authentication (CVSS PR:L), so an attacker must first obtain a valid account on the target WordPress installation - fully unauthenticated visitors cannot exploit it. EPSS, CISA KEV, and public exploit-code status were not provided in the source data, so no active-exploitation signal can be asserted; the vendor's fix version is likewise not enumerated in the available input, and remediation details should be confirmed against the Patchstack advisory.
RemediationAI
The supplied data does not identify a vendor-released fix version, so the primary action is to check the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/hivepress/vulnerability/wordpress-hivepress-plugin-1-7-32-content-injection-vulnerability?_s_id=cve) and the HivePress changelog for the first release above 1.7.32 and upgrade to it, then verify the plugin version string in the WordPress admin after the update. If no patched build is confirmed, the highest-value compensating control is account hygiene: audit every user on the site, remove dormant accounts, and downgrade or delete roles with the ability to reach HivePress front-end submission and listing features, since the exploit path requires an authenticated low-privilege session - the trade-off is reduced self-service functionality for legitimate members. Restrict wp-admin and any HivePress submission endpoints to trusted networks or behind a WAF rule that inspects POST bodies for PHP code tokens such as eval, system, base64_decode, and backticks; this adds latency and can generate false positives on legitimate listing content. If the affected HivePress feature can be identified from the advisory, disable that specific module until patched, accepting the loss of that functionality. Finally, enable file-integrity monitoring and PHP error logging so that anomalous code execution attempts against the plugin surface are detected, and treat any low-privilege account compromise on a HivePress site as potential data exposure given the confidentiality-only impact profile.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
HivePress is a WordPress plugin that extends the CMS with directory, listing, and membership functionality, meaning it executes as PHP inside the WordPress request lifecycle and inherits the CMS's role and capability model. The flaw is classified as CWE-94, Improper Control of Generation of Code, the class of defect in which untrusted input reaches a code-generation sink - in PHP this typically means dynamic evaluation constructs (eval, create_function-style callbacks, dynamic include/require paths, or callable dispatch built from user-supplied strings) rather than the more common SQL injection or cross-site scripting families. Because the vulnerable code path sits behind a WordPress capability check, the effective bar is a low-privilege authenticated account rather than an anonymous visitor, and the CVSS vector supplied by the reporter (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) scopes the consequence to high confidentiality loss with no integrity or availability impact, which is narrower than the blanket 'RCE' and 'Code Injection' tags attached to the report. No CPE identifiers were supplied, so the precise affected artifact should be read as the WordPress plugin slug 'hivepress' at versions up to and including 1.7.32; the exact injectable endpoint, parameter, or feature is not named in the available data and must be read from the Patchstack advisory before constructing detection logic.
Know when Wordpress Plugin gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Network-reachable, low-complexity, and authentication required (PR:L) per the advisory; impact kept confidentiality-only (C:H, I:N, A:N) because the source describes content injection/disclosure, not code execution.
Primary rating from Vendor (patchstack).
CVSS VectorVendor: patchstack
DescriptionCVE.org
Improper Control of Generation of Code ('Code Injection') vulnerability in HivePress HivePress hivepress allows Code Injection.This issue affects HivePress: from n/a through 1.7.32.
Threat Intelligence Overview
NVD
CVE.org
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Code injection occurs when an application accepts user input and passes it directly into a language interpreter or evaluator without proper sanitization.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
More in Wordpress Plugin
View allThe Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
Authentication bypass in the LiteSpeed Cache WordPress plugin (versions prior to 6.5.0.1) allows unauthenticated remote
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The SureTriggers WordPress plugin through version 1.0.82 contains a privilege escalation vulnerability that allows unaut
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
SQL injection in the NotificationX WordPress plugin (versions up to and including 2.8.2) allows unauthenticated remote a
The POST SMTP Mailer - Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress plugin for WordPress i
The MasterStudy LMS WordPress Plugin - for Online Courses and Education plugin for WordPress is vulnerable to union base
The Email Subscribers by Icegram Express plugin for WordPress is vulnerable to SQL Injection via the ‘hash’ parameter in
Remote code execution in the WP Query Console WordPress plugin (versions up to and including 1.0) by Ajit Bohra allows u
Exploit-DB