CVE Intelligence
Analysis AI-assisted

CVE-2026-32539: PublishPress Revisions SQL Injection

CVE-2026-32539 is a blind SQL injection vulnerability (CWE-89) in PublishPress Revisions, a WordPress plugin, as described in the record for versions up to and including 3.7.23. The CNA Patchstack assigned a CVSS 3.1 base score of 9.3 (critical), and the record lists no confirmed exploitation. No fixed version is listed in the sources consulted.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

CVE-2026-32539 describes a blind SQL injection flaw (CWE-89) in the revisionary component of PublishPress Revisions, a WordPress plugin. The record was published on 2026-03-25 by the CNA Patchstack and its source status is Deferred. The description states that the issue affects versions from n/a through 3.7.23.

Impact

SQL injection can allow an attacker who can reach the affected functionality to influence database queries. The record describes this as blind SQL injection, meaning results are inferred indirectly rather than returned directly. The CVSS 3.1 vector reported (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L) indicates network attack, low complexity, no privileges or user interaction required, a scope change, high confidentiality impact, no integrity impact, and low availability impact. The score of 9.3 is the value reported by Patchstack and mirrored by a second provider entry.

Affected products and versions

  • Product: PublishPress Revisions (WordPress plugin), revisionary component.
  • Range stated in the record: from n/a through 3.7.23 (inclusive).
  • The record does not list structured affected or fixed version data.

Exploitation status

The CISA KEV catalog does not list this CVE in the record. No confirmed exploitation appears in the sources consulted.

Remediation and mitigation

  • Identify whether PublishPress Revisions is installed on your WordPress sites and which version is in use.
  • Check the vendor or the plugin's update channel for a release newer than 3.7.23 that addresses this issue. The record does not name a fixed version.
  • Until a fix is confirmed, consider restricting access to administrative and plugin functionality, reviewing the plugin's necessity, and maintaining current backups.
  • Apply the principle of least privilege to database accounts used by WordPress.

Detection guidance

  • Review web server and application logs for unusual request patterns targeting the plugin's endpoints.
  • Monitor database error logs and unexpected query behavior at a high level.
  • Keep WordPress core, themes and plugins inventoried so that exposure can be assessed quickly.

Limitations of the available information

The record lacks structured affected version data, fixed version information, and the specific vulnerable endpoint or parameter. The source reference is a Patchstack database page. The EPSS probability of 0.004 (percentile 0.32418) is reported as a statistical estimate, not as evidence of exploitation. Whether the CVSS scoring reflects deployment specifics is unknown.

Frequently asked questions

What is CVE-2026-32539?

It is a blind SQL injection vulnerability (CWE-89) in the revisionary component of PublishPress Revisions, a WordPress plugin, affecting versions up to and including 3.7.23.

Is this vulnerability known to be exploited?

The CISA KEV catalog does not list this CVE in the record, and no confirmed exploitation appears in the sources consulted.

Which version fixes it?

The record does not list a fixed version. Check the vendor or plugin update channel for a release newer than 3.7.23.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.