CVE-2026-61685

Name of the Vulnerable Software and Affected Versions ReactPress versions prior to 3.7.0

Description API list endpoints build TypeORM QueryBuilder conditions using unsanitized HTTP query parameter names as SQL column identifiers. Because TypeORM parameterizes values but not column names, unauthenticated attackers can perform SQL injection by using crafted query string keys. SQL injection is a technique where malicious SQL statements are inserted into entry fields for execution.

Recommendations Update to version 3.7.0. As a temporary workaround, allowlist allowed filter column names before interpolating them into SQL.