CVE Intelligence
Analysis AI-assisted

CVE-2026-62032: DirectoryPress WordPress Plugin - Unauthenticated Local File Inclusion

CVE-2026-62032 is an unauthenticated Local File Inclusion flaw in the DirectoryPress WordPress plugin by Designinvento, affecting versions up to and including 3.6.27. Patchstack scored it 9.8 (critical) with high impact on confidentiality, integrity and availability. The record lists no fixed version, and the CVE is not listed in CISA KEV.

Published Oct 24, 2026 · Updated Oct 24, 2026 · Ler em português

Overview

The record describes an unauthenticated Local File Inclusion issue in DirectoryPress up to and including 3.6.27. It was published on 2026-10-10 and assigned by the CNA Patchstack. The listed CWE is CWE-98, named PHP Remote File Inclusion, which does not match the local-file wording of the description; this is noted under limitations.

Impact

The CVSS metrics (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) indicate network access, low complexity, no privileges required, no user interaction, unchanged scope, and high impact to confidentiality, integrity and availability. The SSVC data marks technical impact as total and automatable as yes. A file inclusion flaw can expose files readable by the web server and, depending on configuration, may enable further effects; the record does not confirm which outcomes apply here.

Affected products and versions

  • Product: Designinvento DirectoryPress, a WordPress plugin
  • Affected: up to and including 3.6.27
  • Fixed version: not listed in the record

Exploitation status

The record shows the CVE is not listed in CISA KEV. No confirmed exploitation appears in the sources consulted. The SSVC exploitation value is none. The EPSS probability is 0.00349 with a percentile of 0.2734, dated 2026-10-23.

Remediation and mitigation

  • Identify every site running DirectoryPress at 3.6.27 or earlier.
  • Check the Patchstack entry and the vendor for an updated release, since the record gives no fixed version.
  • If no fix is confirmed, consider deactivating the plugin until a patched release is verified.
  • Reduce exposure by restricting access where feasible, keeping WordPress core and other plugins current, and reviewing file permissions on the hosting environment.

Detection guidance

  • Review web server and WordPress access logs for unusual requests to DirectoryPress functionality, especially requests with file-path-like parameters that point to unexpected locations.
  • Monitor for unexpected file reads, new or modified files in plugin and upload directories, and changes to WordPress configuration.

Limitations of the available information

  • No fixed version is recorded, so the remediation status is unknown.
  • CWE-98 (PHP Remote File Inclusion) differs from the Local File Inclusion description; the precise weakness class should be confirmed with the CNA.
  • The record contains no technical details on exploitation, and this analysis does not add any.
  • The record status is Deferred, so the data may change.

Frequently asked questions

Which versions of DirectoryPress are affected by CVE-2026-62032?

The record lists DirectoryPress versions up to and including 3.6.27 as affected, from Designinvento.

Is there a fixed version?

No. The record does not list a fixed version, so check the Patchstack entry and the vendor for an updated release.

Is this vulnerability being actively exploited?

The record shows the CVE is not listed in CISA KEV, and no confirmed exploitation appears in the sources consulted.

What should site owners do now?

Identify affected installations, watch for vendor updates, consider deactivating the plugin if no fix exists, and review logs for unusual requests.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.