Publishpress Revisions CVE-2026-32539

Remote unauthenticated attacker can exploit blind SQL injection in PublishPress Revisions plugin versions <= 3.7.23 through unspecified input parameter. No victim interaction required. Affects WordPress installations with vulnerable plugin enabled.

While CVSS and EPSS scores are unavailable for this CVE, the underlying risk is substantial. SQL injection vulnerabilities, particularly blind variants, typically carry high real-world exploitability due to automation potential and the foundational database access they provide. The affected software is a WordPress plugin with a broad deployment footprint, and the version range (through 3.7.23) suggests a relatively recent discovery. The lack of CVSS/EPSS scoring may indicate this is a newly disclosed vulnerability (CVE-2026 series) still undergoing formal assessment. The presence of Patchstack documentation and ENISA EUVD assignment (EUVD-2026-15913) confirms third-party validation. Exploitation likely requires low to medium attack complexity (crafting SQL payloads) and no authentication if the vulnerable parameter is exposed in unauthenticated endpoints. This should be treated as a high-priority vulnerability for any organization running PublishPress Revisions.

An attacker identifies a vulnerable parameter in PublishPress Revisions' revision handling functionality and crafts a blind SQL injection payload, such as a time-based conditional query that pauses database response if a condition is true. By systematically iterating through character guesses and measuring response times, the attacker extracts sensitive data such as WordPress admin credentials, user email addresses, or plugin/theme configurations from the wp_users or wp_options tables. Once credentials are obtained, the attacker could escalate to full WordPress admin access and deploy malicious plugins or modify site content. No public proof-of-concept is confirmed in the available intelligence, but the straightforward nature of blind SQL injection exploitation suggests weaponizable exploits may be developed quickly.