DirectoryPress Plugin Vulnerable to Critical Unauthenticated File Inclusion

The National Vulnerability Database published CVE-2026-62032 to document a critical security flaw in the DirectoryPress WordPress plugin. This vulnerability allows unauthenticated attackers to include local files on affected servers, posing a severe risk to site integrity and data confidentiality for users relying on this directory management tool.

The weakness is classified under CWE-98, which pertains to improper neutralization of special elements used in an OS command. The National Vulnerability Database assigned a CVSS score of 9.8 to this issue, marking it as critical. This high severity rating reflects the ease with which an attacker can exploit the flaw without needing prior authentication or user interaction.

Context and Background

The vulnerability exists within the DirectoryPress plugin, a popular tool for creating business directories on WordPress sites. According to the NVD record, the flaw allows for unauthenticated local file inclusion. This type of vulnerability typically enables an attacker to read or execute arbitrary files on the server where the application is hosted, potentially leading to full system compromise.

DirectoryPress is developed by Designinvento. The plugin is widely used for listing businesses, services, and contacts. The presence of a critical flaw in such a common plugin highlights the ongoing risks associated with complex web applications that handle dynamic content and file operations.

Who Is Affected

Users running DirectoryPress version 3.6.27 or any earlier version are affected by CVE-2026-62032. The NVD record explicitly states that versions up to 3.6.27 contain this vulnerability. Site administrators who have not updated their plugins or who are using legacy versions remain exposed to potential exploitation by remote attackers.

Designinvento is the vendor responsible for the DirectoryPress plugin. The vulnerability affects all installations of the plugin that have not been patched to a version newer than 3.6.27. Organizations that rely on DirectoryPress for their directory services should immediately verify their installed versions to determine if they fall within the affected range.

What should you do?

Security professionals should audit their WordPress installations for the DirectoryPress plugin. If the installed version is 3.6.27 or lower, the site is vulnerable to CVE-2026-62032. Administrators should check for and apply any available updates from the vendor to mitigate the risk of unauthenticated file inclusion.