Sensitive Data Exposure in DirectoryPress Plugin by Designinvento
CVE-2026-39566

4MEDIUM

Key Information:

Vendor

WordPress
Status
Directorypress
Vendor
CVE Published:
8 April 2026

What is CVE-2026-39566?

The DirectoryPress plugin by Designinvento contains a vulnerability that allows unauthorized users to retrieve sensitive embedded data. This exposure can lead to unauthorized access to confidential information, making it crucial for site administrators to update the plugin to safeguard against potential data breaches. Ensure your version is current to protect against data vulnerabilities.

Affected Version(s)

DirectoryPress 0 <= 3.6.26

References

https://patchstack.com/database/Wordpress/Plugin/director...
vdb-entry

CVSS V3.1

Score:
4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Bao - BlueRock | Patchstack Bug Bounty Program
.