HivePress: Code injection allows remote code inclusion in WordPress plugin
Summary
HivePress, a WordPress plugin for directory websites, up to and including version 1.7.32 contains a code injection flaw (CWE-94) that allows remote code inclusion. According to the Patchstack advisory, an attacker with a low-privilege account, such as a contributor, can run commands on the web server. The exact mechanism and vulnerable component are not described in the sources reviewed. The CNA rates the issue CVSS 9.9, while VulDB lists 6.3, and NVD analysis is pending.
Affected
- HivePress up to and including 1.7.32 (CNA range: from n/a through 1.7.32)
Fixed in
- HivePress 1.8.0 (listed as patched version in the Patchstack advisory and as the solution in the CVE record)
- 1.8.1 is the latest release seen in research; confirm the fixed version on WordPress.org before upgrading
Workaround
Unknown. No plugin-side workaround is documented. Patchstack offers a mitigation rule for its customers until the update is applied.
Exploitation
- Not listed in CISA KEV.
- CISA SSVC assessment: exploitation none, automatable no.
- VulDB: no available exploit.
- A GitHub pull request titled 'Add CVE-2026-110887 research package' was merged on 20 October 2026. Its content was not reviewed, so treat it as a possible public proof of concept.
- Patchstack expects exploitation and mass-exploit use.
Our recommendation
- Update HivePress to 1.8.0 or later, preferably the latest release, after checking the Patchstack advisory or the WordPress.org changelog.
- Inventory all WordPress sites with HivePress and record their versions.
- Review user-registration and contributor or vendor roles, and remove unneeded accounts.
- Review logs for signs of compromise, such as unknown files or new administrator accounts.
- Do not run code from the possible proof of concept on production systems.
- Recheck the NVD record once analysis is complete.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Patchstack advisory for HivePress plugin up to 1.7.32 patchstack.com
- HivePress 1.8.0 release notes github.com
- HivePress 1.8.1 announcement community.hivepress.io
- VulDB entry 422298 vuldb.com
- OpenCVE entry for CVE-2026-110887 app.opencve.io
- GitHub pull request: research package (possible PoC, not reviewed) github.com
- HOL Guard entry for CVE-2026-110887 hol.org
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 15:15.
Original description (NVD)
Improper Control of Generation of Code ('Code Injection') vulnerability in HivePress HivePress hivepress allows Remote Code Inclusion.This issue affects HivePress: from n/a through 1.7.32.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.