CVE Catalog
CVE-2026-39566
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk0.19%
9th percentile - higher than 9% of all known CVEs
Summary
The DirectoryPress plugin for WordPress exposes sensitive system information to unauthorized entities. The vulnerability allows retrieval of embedded sensitive data.
Risk Assessment
An attacker can access confidential system information, potentially leading to further attacks or data leakage.
Recommendation
Update the DirectoryPress plugin to version 3.6.27 or later.
Original NVD description (English source)
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Designinvento DirectoryPress directorypress allows Retrieve Embedded Sensitive Data.This issue affects DirectoryPress: from n/a through <= 3.6.26.