RealPress CVE-2026-66458

The prerequisite is simply a reachable WordPress site with the RealPress plugin (version ≤ 1.1.2) installed and activated; the CVSS vector AV:N/AC:L/PR:N/UI:N confirms no authentication, no special privileges, and no user interaction are needed, so exploitation works against default installations exposed over the network. The main limiting factor is deployment scope - the target must actually run this specific ThimPress plugin - and the attacker must reach the vulnerable endpoint (not blocked by a WAF or access controls). No non-default configuration setting or particular platform is required by the available data.

The signals are moderately strong but incomplete. The CVSS vector (AV:N/AC:L/PR:N/UI:N) describes the most dangerous class of web flaw - remote, network-reachable, low-complexity, and pre-authentication - which is why it scores 9.3, and SQL injection against a WordPress database is a well-understood, easily automatable attack pattern. Countervailing that, no EPSS score was supplied, there is no KEV listing, and no public proof-of-concept is indicated, so there is no evidence of active or widespread exploitation yet; the real-world urgency therefore rests on the product's deployment footprint, which for this niche plugin is limited. The vendor-supplied vector claims a changed scope (S:C) and availability impact (A:L) with no integrity impact (I:N), which is somewhat atypical for classic read-oriented SQLi and worth verifying against the Patchstack advisory. Because exploitation needs no credentials, any organization exposing a vulnerable RealPress install to the internet - a small business or a mid-sized municipal IT team alike - should treat patching as time-sensitive rather than deferrable, even absent an observed exploit.

An unauthenticated attacker scans for WordPress sites running RealPress, then sends a single crafted HTTP request in which a vulnerable parameter carries SQL payload; the injected syntax executes against the site database and returns or infers data such as administrator email addresses and password hashes. Because no login or user interaction is required and complexity is low, the request can be fully automated across many targets. No public proof-of-concept is identified at time of analysis, so an attacker would need to derive the injection point from the advisory or their own testing.