Sensitive Data Exposure in DirectoryPress Plugin by Designinvento
CVE-2026-39566

4.3MEDIUM

Key Information:

Vendor

WordPress
Status
Directorypress
Vendor
CVE Published:
8 April 2026

What is CVE-2026-39566?

The DirectoryPress plugin by Designinvento contains a vulnerability that allows unauthorized users to retrieve sensitive embedded data. This exposure can lead to unauthorized access to confidential information, making it crucial for site administrators to update the plugin to safeguard against potential data breaches. Ensure your version is current to protect against data vulnerabilities.

Affected Version(s)

DirectoryPress 0 <= 3.6.26

References

https://patchstack.com/database/Wordpress/Plugin/director...
vdb-entry

CVSS V3.1

Score:
4.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Bao - BlueRock | Patchstack Bug Bounty Program
.