Subscriber Privilege Escalation Vulnerability in Directories Pro Plugin by WordPress
CVE-2026-66661

7.7HIGH

Key Information:

Vendor

WordPress
Status
Directories Pro
Vendor
CVE Published:
13 August 2026

What is CVE-2026-66661?

A vulnerability in the Directories Pro plugin allows subscribers to escalate their privileges, which may enable unauthorized access to sensitive features and functionalities within the platform. This affects all versions up to 2.0.5, posing a significant security risk to users and requiring immediate attention for remediation.

Affected Version(s)

Directories Pro <= 2.0.5

References

https://patchstack.com/database/wordpress/plugin/director...
vdb-entry

CVSS V3.1

Score:
7.7
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Nguyen Ba Khanh - HPT Vietnam Corporation | Patchstack Bug Bounty Program
.