Access Control Vulnerability in Directory Pro by e-plugins
CVE-2026-27396

7.3HIGH

Key Information:

Vendor

WordPress
Status
Directory Pro
Vendor
CVE Published:
5 March 2026

What is CVE-2026-27396?

Directory Pro, a directory management plugin by e-plugins, suffers from a missing authorization vulnerability that allows attackers to exploit incorrectly configured access control security levels. This results in unauthorized access to restricted areas. The vulnerability affects Directory Pro versions up to 2.5.6, emphasizing the need for prompt updates to maintain security.

Affected Version(s)

Directory Pro 0 <= 2.5.6

References

https://patchstack.com/database/Wordpress/Plugin/director...
vdb-entry

CVSS V3.1

Score:
7.3
Severity:
HIGH
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Phat RiO | Patchstack Bug Bounty Program
.