ReactPress CVE-2026-92712

Requires an authenticated account at subscriber level or above on a WordPress site with the ReactPress - Create React App for WordPress plugin (version ≤3.4.0) installed and active. The attacker must supply a 'permalink' value that survives sanitize_url() (a valid URL) pointing to attacker-controlled remote content; the plugin then fetches that URL and writes the raw response body to disk. Limiting factors: exploitation depends on the plugin being installed, on the attacker holding at least a subscriber account (so sites that disable open registration substantially reduce exposure), and on a victim subsequently visiting the poisoned page for the stored script to execute.

This is a genuine but bounded risk. The provided CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N, base 6.4) indicates a network-reachable, low-complexity flaw requiring only authenticated subscriber-level access (PR:L) and no user interaction, with a scope change (S:C) reflecting that injected script executes in the context of any visitor to the poisoned page. No EPSS score, KEV listing, POC flag, or SSVC decision data was supplied in the input, so exploitation-likelihood signals are absent - this is scored on CVSS and the Wordfence technical description alone. The impact is limited to Low confidentiality and Low integrity (session/DOM-level effects typical of stored XSS), with no availability impact. The mechanism is more interesting than a typical reflected XSS: the 'permalink' parameter is only run through sanitize_url(), which does not block fetching an attacker-controlled remote URL, and the response body is written verbatim to disk via file_put_contents() - so this couples a fetch primitive with persistent script storage. Net: a real, patch-worthy issue but not an emergency-tier one - the subscriber-authentication requirement and lack of any confirmed exploitation temper the raw 6.4. No conflicting signals between vector and description were found.

An attacker who has registered a low-privilege subscriber account on a WordPress site running ReactPress ≤3.4.0 submits a crafted 'permalink' value pointing at a remote URL they control. The plugin fetches that URL and writes the response body - containing <script> tags and event-handler attributes - verbatim to disk, so the payload executes in the browser of any user who later loads the affected page. No public exploit was identified at time of analysis, and no user interaction is required for the payload to fire once stored.