What is the CVSS score of EUVD-2026-57877?

EUVD-2026-57877 has a CVSS 3.1 base score of 9.3 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L. EPSS exploitation probability: 0.3%.

Which versions of RealPress are affected by EUVD-2026-57877?

WordPress sites running RealPress plugin (ThimPress, versions ≤1.1.2) face critical risk of unauthorized database breach through unauthenticated SQL injection.

How to fix or mitigate EUVD-2026-57877?

Within 24 hours: Audit all WordPress installations for RealPress plugin; immediately disable and remove the plugin; review database access logs and query logs for SQL injection attempts. Within 7 days: Rotate all database credentials and user passwords; restore affected databases from verified clean backups; audit exported user data and password hashes for unauthorized access; review user account activity for compromise indicators. Within 30 days: Monitor ThimPress advisory channels for patch availability; implement Web Application Firewall (WAF) rules targeting SQL injection patterns as interim protection; migrate to an actively maintained alternative press management plugin.

RealPress EUVD-2026-57877

| CVE-2026-66458 CRITICAL

SQL Injection (CWE-89)

2026-08-13 Patchstack

GHSA-f3gr-699v-ghmj

WordPress SQLi Wordpress Plugin Realpress Thimpress

9.3

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

9.3 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L

vuln.today AI

7.5 HIGH

Unauthenticated low-complexity network SQLi yields high confidentiality via database read; scope kept unchanged as impact stays within the WordPress DB, with no confirmed integrity or availability effect.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

None

Availability

Low

Lifecycle Timeline

Analysis Generated

Aug 13, 2026 - 14:34 vuln.today

CVE Published

Aug 13, 2026 - 13:37 cve.org

CRITICAL 9.3

DescriptionCVE.org

Unauthenticated SQL Injection in RealPress <= 1.1.2 versions.

AnalysisAI

Unauthenticated SQL injection in the RealPress WordPress plugin (by ThimPress) affects all versions up to and including 1.1.2, letting remote attackers with no credentials inject crafted SQL through an exposed parameter and read arbitrary data from the site's database. Reported by Patchstack and rated CVSS 9.3, the flaw requires no authentication or user interaction, though there is no public exploit identified at time of analysis and it is not listed in CISA KEV. The primary consequence is disclosure of sensitive database contents such as user records and credential hashes.

Technical ContextAI

RealPress is a plugin extending WordPress, a PHP application that stores content and user data in a MySQL/MariaDB backend (CPE cpe:2.3:a:thimpress:realpress). The root cause is CWE-89 (Improper Neutralization of Special Elements used in an SQL Command): user-controllable input is concatenated into a SQL query without parameterization or proper sanitization/escaping, so attacker-supplied syntax is interpreted as part of the query. In WordPress plugins this typically arises when request parameters are passed to $wpdb methods or raw queries without prepare()/placeholders, exposing the shared WordPress database to untrusted callers.

RemediationAI

Upgrade RealPress to a fixed release newer than 1.1.2; the input data does not specify an exact patched version number, so consult the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/realpress/vulnerability/wordpress-realpress-plugin-1-1-2-sql-injection-vulnerability) and the ThimPress changelog to confirm the fixed build before deploying. If an update cannot be applied immediately, deactivate and remove the RealPress plugin to eliminate exposure (trade-off: any RealPress-provided functionality is lost), or place the site behind a WAF with SQL-injection rules and virtual-patching for this CVE (trade-off: signature rules can be bypassed and are a stopgap, not a fix). Additionally restrict the WordPress database account's privileges to the minimum needed and monitor for anomalous query patterns to limit and detect exploitation while patching is scheduled.