DirectoryPress WordPress plugin: Unauthenticated Local File Inclusion

Summary

DirectoryPress, a WordPress plugin for business directories and classified listings, contains an unauthenticated Local File Inclusion vulnerability (CVE-2026-62032, CVSS 9.8, CWE-98). An unauthenticated remote attacker can make the website load arbitrary server files, which can expose configuration files such as database credentials and can lead to a full site takeover depending on server configuration. Exploitation requires no user interaction, and any internet-facing site running a vulnerable version is exposed.

Affected

• DirectoryPress WordPress plugin, all versions up to and including 3.6.27
• The lower bound of the affected range is unknown.

Fixed in

• Unknown. No fixed version has been published by the vendor at the time of writing.
• Do not assume that version 3.6.27 is safe.

Workaround

• No vendor workaround published.
• Disable or remove the plugin if the directory functionality is not business-critical.
• Restrict access to the site where possible and check whether listing features are reachable without login.
• Use WAF or virtual patching from a security service if available; effectiveness is unconfirmed.

Exploitation

• Exploited in the wild: no evidence found.
• Not listed in CISA KEV according to the sources checked.
• Public proof of concept: none found in the sources checked.
• CISA SSVC: exploitation none, automatable yes, technical impact total.
• Patchstack rates the issue as high priority and expects exploitation.

Our recommendation

• Inventory all WordPress sites running DirectoryPress, including staging sites and addons.
• Treat internet-facing sites as high priority: disable or isolate them, or apply WAF or virtual patching.
• Review web server logs and file integrity for signs of abuse, and keep backups ready.
• Monitor the Patchstack advisory and the vendor channels for a fixed release and update as soon as one is confirmed.
• Recheck the fixed version and exploitation status in one to two weeks, as the record is still under analysis.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Patchstack advisory patchstack.com
• WordPress.org plugin page wordpress.org
• VulDB vuldb.com
• OpenCVE app.opencve.io
• HOL Guard hol.org
• Strix www.strix.ai
• Vulners Rapid7 vulners.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 19:40.