External risk intelligence

HivePress Remote Code Inclusion Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.9)

CVE-2026-110887

HivePress is a WordPress plugin designed to add directory and classifieds functionality to websites. Such plugins are typically deployed as public-facing web components, making their features and interfaces directly accessible over the internet to end users, which creates a likely public attack surface.

Code Injection

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability has been identified in the HivePress plugin, which allows for remote code inclusion. This means an attacker could potentially insert and execute their own code on affected systems, leading to unauthorized access and control. The primary concern is to determine if this plugin is in use and, if so, whether the affected version is deployed within our environment.

Allows attackers to run custom code remotely.
Critical risk for public-facing WordPress sites.
Confirm relevance and assess exposure.

Attack Path

How an attacker could exploit the issue

An attacker with low-privileged access could exploit this vulnerability by sending specially crafted input to a vulnerable component within the HivePress plugin. This could lead to the inclusion of remote code, potentially allowing the attacker to execute arbitrary commands on the affected system.

Requires low-privileged access.
Triggered by crafted input to a component.
Enables remote code inclusion.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an unauthenticated attacker to include and execute arbitrary code on the server when the affected plugin is running. This could lead to a compromise of the server hosting the website.

Server-side code execution.
Exploited via a vulnerable web request.
Complete system control.

Operational Fix

Recommended remediation, mitigation, and detection steps

In real-world scenarios, the HivePress plugin, as a component of WordPress websites, would likely fall under the purview of the website's application owners or the internal web development team responsible for managing plugins. Initial actions should focus on inventorying all instances of HivePress, assessing their internet reachability and business criticality, identifying the specific site owner for each instance, and then developing a risk-based remediation plan.

Application owners should manage the issue.
Verify internet-facing HivePress instances.
Plan coordinated updates during maintenance.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the HivePress plugin used for?

HivePress is a WordPress plugin that extends a website's functionality by enabling directory and classifieds features. It transforms a standard site into a platform where users can post listings, manage submissions, and interact with specialized content types, often serving as a central hub for community or commercial marketplaces.

What does 'Code Injection' mean in CVE-2026-110887?

This vulnerability, classified as CWE-94, refers to a flaw where the software incorrectly handles input, allowing an attacker to inject and execute unauthorized code. In this specific case, it enables remote code inclusion, meaning the plugin can be tricked into loading and running external commands that the attacker provides, essentially bypassing the intended logic of the application.

How is this vulnerability triggered?

An attacker triggers this by sending specially crafted input to a vulnerable component within the plugin. While it requires low-privileged access to interact with the system, it does not require administrative or high-level access. Normal interactions that do not involve sending malicious, specifically formatted data to the affected component will not trigger the vulnerability.

Why is this CVE considered high risk?

Halo Surface Signal identifies this as high risk because HivePress is typically deployed on public-facing websites. Since the plugin's features are designed to be accessible to end users over the internet, an attacker can attempt to exploit this remotely without needing to be inside the internal network, making the vulnerability directly reachable.

Do I need to check my WordPress sites for this?

Yes, you should begin by inventorying all WordPress installations to identify which ones use the HivePress plugin and confirm if they are running version 1.7.32 or earlier. Once you have a list, verify which instances are accessible from the internet and coordinate with the site owners to plan an update as part of your standard maintenance workflow.

References

patchstack.com/database/wordpress/plugin/hivepress/vulnerability/wor…

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.