CVE-2026-62032

Local File Inclusion vulnerability in DirectoryPress versions up to and including 3.6.27. An unauthenticated attacker can include local files, potentially leading to information disclosure or code execution. The issue affects unauthenticated access.

An unauthenticated attacker can remotely exploit the vulnerability without logging in, posing a risk of sensitive data disclosure or further system compromise. Organizations using the vulnerable version are exposed to attack.

Update DirectoryPress to a version later than 3.6.27 or apply available security patches. Until updated, consider restricting access to the application.