CVE-2025-64243

MediumCVSS 4.3

Published: 16/12/2025(UTC)Updated: 07/10/2026(UTC)Translated: 08/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.22%

11th percentile - higher than 11% of all known CVEs

Summary

Missing Authorization vulnerability in Directory Pro plugin up to version 2.5.6, allowing exploitation of incorrectly configured access control security levels.

Risk Assessment

Unauthorized individuals may gain access to administrative functions or data, potentially leading to integrity and confidentiality breaches.

Recommendation

Update the plugin to the latest version or configure proper access permissions.

Other vulnerabilities in Directory Pro

CVE-2026-66649Critical
Unauthenticated SQL Injection vulnerability in Directory Pro versions up to 2.5.8. An attacker can manipulate database queries.

Original NVD description (English source)

Missing Authorization vulnerability in e-plugins Directory Pro directory-pro allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Directory Pro: from n/a through <= 2.5.6.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS