Description
Improper Control of Generation of Code ('Code Injection') vulnerability in HivePress HivePress hivepress allows Code Injection.This issue affects HivePress: from n/a through 1.7.32.
Published: 2026-10-18
Score: 6.5 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Code injection via improper generation of code
Action: Immediate Patch
AI Analysis

Impact

The HivePress WordPress plugin contains an Improper Control of Generation of Code vulnerability (CWE‑94) that allows an attacker to inject arbitrary code. The flaw exists in plugin versions through 1.7.32 and may enable the attacker to execute malicious code on the affected WordPress site, compromising confidentiality, integrity, and availability.

Affected Systems

HivePress plugin for WordPress, any version up to and including 1.7.32. The vulnerability is present from the initial release (n/a) through 1.7.32.

Risk and Exploitability

The CVSS score of 6.5 indicates a medium severity, and the EPSS score is currently unavailable, so the exploitation probability is unknown. The vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that the injection can be triggered through plugin input fields or data submission endpoints, suggesting that an attacker may exploit the flaw by submitting crafted data that the plugin processes as executable code.

Generated by OpenCVE AI on October 18, 2026 at 12:32 UTC.

Remediation

Vendor Solution

Update the WordPress HivePress plugin to the latest available version (at least 1.8.0).

OpenCVE Recommended Actions

  • Update the HivePress plugin to version 1.8.0 or later.
  • Configure the plugin or WordPress instance to disable any functionality that allows arbitrary code generation or execution.
  • Review custom code or extensions that interact with HivePress to ensure proper input validation and escaping.

Generated by OpenCVE AI on October 18, 2026 at 12:32 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 19 Oct 2026 20:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Sun, 18 Oct 2026 11:15:00 +0000

Type Values Removed Values Added
Description Improper Control of Generation of Code ('Code Injection') vulnerability in HivePress HivePress hivepress allows Code Injection.This issue affects HivePress: from n/a through 1.7.32.
Title WordPress HivePress plugin <= 1.7.32 - Content Injection vulnerability
Weaknesses CWE-94
References
Metrics cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N'}

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: Patchstack

Published:

Updated: 2026-10-19T19:03:21.300Z

Reserved: 2026-10-15T00:19:27.826Z

Link: CVE-2026-110885

cve-icon Vulnrichment

Updated: 2026-10-19T19:03:17.215Z

cve-icon NVD

Status : Deferred

Published: 2026-10-18T11:16:37.330

Modified: 2026-10-19T20:17:52.147

Link: CVE-2026-110885

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-18T12:45:01Z

Weaknesses
  • CWE-94

    Improper Control of Generation of Code ('Code Injection')