This vulnerability (CVE-2026-66458) is an instance of CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in the RealPress product by ThimPress. It affects all versions up to and including 1.1.2. The flaw allows unauthenticated attackers to inject SQL commands, which can lead to a complete compromise of data confidentiality and partial disruption of service. The CVSS v3.1 base score is 9.3, reflecting network attack vector, low attack complexity, no privileges or user interaction required, and a scope change with high confidentiality impact and low availability impact. No vendor advisory or patch information is currently available.

An unauthenticated attacker can exploit this SQL Injection vulnerability to execute arbitrary SQL commands on the backend database. This can lead to unauthorized disclosure of sensitive information (high confidentiality impact) and limited disruption of service (low availability impact). The integrity impact is not indicated. The vulnerability can be exploited remotely without authentication or user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, consider applying temporary mitigations such as web application firewalls or input validation controls if feasible. Monitor vendor channels for updates.