Platform
wordpress
Component
revisionary
Opgelost in
3.7.24
CVE-2026-32539 is a critical SQL Injection vulnerability discovered in PublishPress Revisions, a WordPress plugin. This flaw allows attackers to perform Blind SQL Injection, potentially leading to unauthorized data access and manipulation. The vulnerability impacts versions of PublishPress Revisions prior to 3.7.24, and a patch has been released.
The SQL Injection vulnerability in PublishPress Revisions allows an attacker to inject malicious SQL code into database queries. Because it's a Blind SQL Injection, the attacker doesn't receive direct output from the database. Instead, they infer information by observing the application's behavior based on crafted SQL queries. This can be used to extract sensitive data such as user credentials, post content, and other stored information. While exploitation is indirect, it can be time-consuming and requires a deep understanding of the database schema, but the potential impact is significant, especially if the database contains sensitive user data or critical application configurations. Successful exploitation could lead to complete compromise of the WordPress site and its associated data.
CVE-2026-32539 was publicly disclosed on 2026-03-25. No public proof-of-concept (PoC) code has been released at the time of writing, but the nature of Blind SQL Injection means that exploitation is feasible with sufficient effort. The vulnerability is not currently listed on the CISA KEV catalog. The CVSS score of 9.3 indicates a critical severity, suggesting a high likelihood of exploitation if the vulnerability remains unpatched.
WordPress sites utilizing PublishPress Revisions plugin, particularly those running older versions (prior to 3.7.24), are at risk. Shared hosting environments where plugin updates are not managed by the site administrator are also particularly vulnerable. Sites that store sensitive user data within the WordPress database are at the highest risk.
• wordpress / composer / npm:
grep -r "SELECT .* FROM" /var/www/html/wp-content/plugins/publishpress-revisions/• generic web:
curl -I https://your-wordpress-site.com/wp-admin/admin-ajax.php?action=revisionary_get_revisions&post_id=1 2>&1 | grep SQL• wordpress / composer / npm:
wp plugin list --status=all | grep publishpress-revisionsdisclosure
Exploit Status
EPSS
0.04% (12% percentiel)
CVSS-vector
The primary mitigation for CVE-2026-32539 is to immediately upgrade PublishPress Revisions to version 3.7.24 or later. If upgrading is not immediately feasible due to compatibility issues or breaking changes, consider temporarily restricting access to the affected functionality or implementing stricter input validation on user-supplied data. Web Application Firewalls (WAFs) configured with rules to detect and block SQL injection attempts can provide an additional layer of defense. Monitor WordPress error logs and database activity for suspicious queries that might indicate an ongoing attack. After upgrading, confirm the vulnerability is resolved by attempting a test SQL injection payload on the affected endpoint and verifying that it is properly sanitized.
Update naar versie 3.7.24, of een nieuwere gepatchte versie
Kwetsbaarheidsanalyses en kritieke waarschuwingen direct in uw inbox.
CVE-2026-32539 is a critical SQL Injection vulnerability affecting PublishPress Revisions versions up to 3.7.23, allowing attackers to potentially extract sensitive data through Blind SQL Injection.
You are affected if you are using PublishPress Revisions version 3.7.23 or earlier. Immediately check your plugin version and upgrade if necessary.
Upgrade PublishPress Revisions to version 3.7.24 or later to resolve the vulnerability. Consider temporary mitigations like WAF rules if immediate upgrade is not possible.
While no active exploitation has been publicly confirmed, the critical severity and nature of Blind SQL Injection suggest a high potential for exploitation.
Refer to the official PublishPress security advisory on their website for detailed information and updates regarding CVE-2026-32539.
Upload je dependency-bestand en kom direct te weten of deze en andere CVEs jou raken.
Upload je dependency-bestand en kom direct te weten of deze en andere CVEs jou raken.