The HivePress plugin contains a vulnerability where untrusted input is used to generate code, enabling an attacker to execute arbitrary code on the server. This is a Code Injection flaw (CWE‑94). The flaw could allow a remote attacker to run commands, exfiltrate data, or compromise the entire WordPress installation.

All installations of the HivePress WordPress plugin from the initial release through version 1.7.32 are vulnerable. The affected vendor is HivePress and the plugin is integrated in WordPress sites. Sites using any of these plugin versions are at risk.

The CVSS score is 9.9, indicating critical severity. No EPSS score is available, and the vulnerability is not listed in KEV. The likely attack vector is remote, as the flaw is triggered by crafted requests to the plugin’s endpoints. An attacker could exploit this if the site is reachable on the Internet, making the threat high if the plugin has not been updated.