CVE-2026-66649

CriticalCVSS 9.3

Published: 20/08/2026(UTC)Updated: 20/08/2026(UTC)Translated: 20/08/2026(UTC)NVD NIST

Summary

Unauthenticated SQL Injection vulnerability in Directory Pro versions up to 2.5.8. An attacker can manipulate database queries.

Risk of unauthorized access to data, modification or deletion, and potential administrator account takeover.

Update the Directory Pro plugin to the latest version that includes the security fix.

Original NVD description (English source)

Unauthenticated SQL Injection in Directory Pro <= 2.5.8 versions.