CVE-2026-39566
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk9th percentile - higher than 9% of all known CVEs
Summary
The DirectoryPress plugin for WordPress exposes sensitive system information to unauthorized entities. The vulnerability allows retrieval of embedded sensitive data.
Risk Assessment
An attacker can access confidential system information, potentially leading to further attacks or data leakage.
Recommendation
Update the DirectoryPress plugin to version 3.6.27 or later.
Other vulnerabilities in DirectoryPress
See all- CVE-2026-62032Critical
Local File Inclusion vulnerability in DirectoryPress versions up to and including 3.6.27. An unauthenticated attacker can include local files, potentially leading to information disclosure or code execution. The issue affects unauthenticated access.
- CVE-2025-62967Medium
The DirectoryPress plugin (directorypress) is vulnerable to DOM-Based XSS due to improper neutralization of input during web page generation. This issue affects versions from n/a through <= 3.6.25.
Original NVD description (English source)
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Designinvento DirectoryPress directorypress allows Retrieve Embedded Sensitive Data.This issue affects DirectoryPress: from n/a through <= 3.6.26.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS