Zero Radar
← feed
CriticalVulnerabilityCVE-2026-110887updated 25 Oct 2026, 15:20 UTC

HivePress WordPress plugin lets attackers inject and run code remotely

Attackers can trick the plugin into loading and running their own code on your website. That can let them take control of the site.

Official, 2 sources
SeverityCriticalCVSS 9.9 of 10
Being exploited?UnclearNo reports either way yet
Fix available?UnclearNo fixed version published in the sources yet
How sure is this?Official, 2 sourcesBacked by an official source

How the attack works simplified

  1. 1AttackerSends crafted request to the site
  2. 2Vulnerable endpointPlugin accepts unvalidated input
  3. 3Remote code includedAttacker's code is loaded and executed
  4. 4Server compromisedAttacker runs commands on the server
  5. ResultAttacker controls the website server

What happened

The HivePress plugin for WordPress has a code injection flaw (CWE-94) that allows remote code inclusion, rated critical with CVSS 9.9.

Why it is dangerous: An attacker could run arbitrary code on the server, potentially taking over the website and its data. Any site running the affected plugin is at risk.

Are you affected?

You are affected if you run the HivePress (hivepress) plugin version 1.7.32 or earlier on your WordPress site.

HivePress (hivepress) plugin: all versions through 1.7.32

What to do

  1. Check whether the HivePress plugin is installed and what version it is
  2. Update HivePress to a version newer than 1.7.32 as soon as a fixed release is available
  3. If no fix is available yet, deactivate the HivePress plugin until a patched version is released
  4. Review the site for unexpected files or changes, and watch the official advisory for updates

Timeline

  1. 19 Oct 2026, 10:16 UTC
    Publicly disclosed
  2. 19 Oct 2026, 10:16 UTC
    Reported by NVD · NVD
  3. 25 Oct 2026, 15:20 UTC
    GitHub Advisory reported on it · GitHub Advisory

Sources 2 reports, oldest first

Official vendor, government CERT or advisory database

Technical details

ID
CVE-2026-110887 · GHSA-6536-vr78-8v3q
CVSS
9.9 / 10
EPSS
0.4% chance of exploitation within 30 days
Disclosed
19 Oct 2026, 10:16 UTC
On Zero Radar
before the radar started
Last change
25 Oct 2026, 15:20 UTC

The plain-language parts and the attack diagram were written by an AI model (anthropic/claude-haiku-5.5) from the sources above. Facts like versions, exploitation and dates come from the sources themselves. How Zero Radar works

HivePress WordPress plugin lets attackers inject and run code remotely · Zero Radar