HivePress CVE-2026-110887

Exploitation requires an authenticated low-privileged account on the target WordPress site (CVSS PR:L) running HivePress version n/a through 1.7.32; no user interaction is needed (UI:N) and the attack is network-reachable (AV:N) with low complexity (AC:L). The practical limiting factor is obtaining that account - but HivePress drives listing/marketplace sites that commonly enable open user or vendor self-registration, so the authentication barrier is frequently low in production. The input description does not name the exact vulnerable feature, parameter, or configuration setting that triggers the code injection, so the precise trigger path could not be confirmed from available data; sites that disable public registration materially reduce exposure.

This is a genuinely high-priority issue, not merely a high-CVSS paper tiger. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H, 9.9) describes network-reachable, low-complexity code injection (CWE-94) that requires only a low-privileged account and no user interaction, yielding full confidentiality, integrity, and availability impact with a scope change - consistent with remote code execution on the hosting server. The key mitigating factor is PR:L: exploitation requires authentication, so this is NOT a fully unauthenticated flaw. However, HivePress powers directory/marketplace sites that typically permit self-service user or vendor registration, which can make a low-privileged account trivial to obtain, effectively lowering the authentication barrier in real deployments. No EPSS score, CISA KEV listing, or public POC was provided in the input, so exploitation activity is unconfirmed; the absence of these signals should be read as 'not yet observed/published,' not as evidence of low risk, given the high technical impact. The CVSS vector and the Patchstack description (RCE / Remote Code Inclusion) are mutually consistent, with no network-vs-local contradiction. Bottom line: treat as high-priority patching for any internet-facing HivePress site, especially those allowing open registration.

An attacker registers a low-privileged account on a public WordPress site running HivePress (<= 1.7.32), then submits crafted input to a vulnerable plugin endpoint or parameter that is improperly evaluated as code. Because the flaw is network-exploitable with low complexity and no user interaction, the injected PHP executes on the server, giving the attacker remote code execution and, due to the scope change, control extending beyond the web application. No public exploit was identified at time of analysis, so the attacker would need to develop their own exploit from the patch diff or plugin code.