{"id":"CVE-2026-110887","kind":"vulnerability","aliases":["CVE-2026-110887"],"related":[],"title":"Improper Control of Generation of Code ('Code Injection') vulnerability in HivePress HivePress hivepress allows…","description":"Improper Control of Generation of Code ('Code Injection') vulnerability in HivePress HivePress hivepress allows Remote Code Inclusion.This issue affects HivePress: from n/a through 1.7.32.","summary":"HivePress, a WordPress plugin, has a code injection flaw that lets remote code be included and run. An attacker can likely run code on the affected WordPress site.","severity":"critical","cvss":9.9,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["hivepress","package","wordpress"],"not_affected_if":["hivepress-not-installed"],"how_to_check":"Check the installed HivePress plugin version in the WordPress admin plugins page; versions through 1.7.32 are affected.","fix":"Update HivePress to a version later than 1.7.32; the patched version is unknown from the sources.","status":"open","published_at":"2026-10-19T10:16:45+00:00","first_seen_at":"2026-10-23T21:57:17+00:00","triaged_at":"2026-10-23T21:59:57+00:00","updated_at":"2026-10-23T22:28:56+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-23T21:59:57Z","model":"claude-haiku-5-5","output":{"fix":"Update HivePress to a version later than 1.7.32; the patched version is unknown from the sources.","reach":"internet","impact":"high","summary":"HivePress, a WordPress plugin, has a code injection flaw that lets remote code be included and run. An attacker can likely run code on the affected WordPress site.","category":"package","who_cares":["wordpress","hivepress"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Attacker runs arbitrary code on the WordPress server.","analyst_note":"Confirm the fixed HivePress version and whether unauthenticated exploitation is possible via the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-110887.","how_to_check":"Check the installed HivePress plugin version in the WordPress admin plugins page; versions through 1.7.32 are affected.","needs_analyst":true,"not_affected_if":["hivepress-not-installed"],"user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000458,"input_tokens":2736,"output_tokens":369,"severity_before":"critical"},"analyst_status":null,"analyst_note":null,"search":"'-110887':17A,20A '-2026':16A,19A '1.7.32':75C 'affect':49B,70C 'allow':14A,65C 'attack':42B 'code':6A,7A,30B,36B,46B,57C,58C,67C 'control':2A,53C 'cve':15A,18A 'flaw':32B 'generat':4A,55C 'hivepress':11A,12A,13A,21B,24B,62C,63C,64C,71C 'improp':1A,52C 'includ':38B 'inclusion.this':68C 'inject':8A,31B,59C 'issu':69C 'let':34B 'like':44B 'n/a':73C 'packag':22B 'plugin':27B 'remot':35B,66C 'run':40B,45B 'site':51B 'vulner':9A,60C 'wordpress':23B,26B,50B","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-19T10:16:45+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-110887","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110887","severity":null,"published_at":"2026-10-19T10:16:45+00:00","modified_at":"2026-10-19T17:17:02+00:00","first_seen_at":"2026-10-23T21:57:17+00:00","fetched_at":"2026-10-23T22:28:56+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}