Unauthenticated LFI in DirectoryPress 3.6.27 Exposes Organisations to Critical Risk

Organisations relying on the DirectoryPress plugin for directory management face a severe security exposure due to a newly disclosed critical vulnerability. The flaw, identified as CVE-2026-62032, allows attackers to perform Local File Inclusion without needing any form of authentication. This means any unauthenticated user can potentially exploit the weakness to access sensitive files on the server, leading to a complete compromise of the affected WordPress installation.

The National Vulnerability Database has assigned a CVSS score of 9.8 to this issue, categorising it as Critical. This high severity rating reflects the ease with which an attacker can exploit the flaw and the significant impact on confidentiality, integrity, and availability. The vulnerability stems from improper handling of user input, specifically mapped to CWE-98, which involves the inclusion of functionally untrusted code via local files.

What we know

The vulnerability specifically impacts the DirectoryPress plugin developed by Designinvento. According to the NVD record, all versions of the plugin up to and including 3.6.27 are affected. There is no mention of a specific version that patches this issue in the current source material, leaving users of these older versions exposed. The lack of authentication requirements for exploitation makes this a particularly dangerous vector for automated scanning tools and opportunistic attackers.

Local File Inclusion flaws typically allow an attacker to specify a file path that the application then includes and executes. In the context of a web application like DirectoryPress, this could enable the inclusion of sensitive server files, such as configuration files containing database credentials. If an attacker gains access to these credentials, they can further compromise the underlying database and potentially move laterally within the organisation’s network infrastructure.

The NVD description explicitly states that the issue is an "Unauthenticated Local File Inclusion". This classification indicates that the application fails to properly validate or sanitise file path parameters provided by the user. Without proper validation, the application trusts the input and includes the specified file in its execution context. This behaviour bypasses standard security controls that rely on authentication to restrict access to sensitive operations.

Defender's checklist

• Verify the installed version of the DirectoryPress plugin on all managed WordPress sites.
• Check server logs for unusual file access patterns or requests containing file path parameters.
• Review web application firewall rules to block potential Local File Inclusion attack signatures.
• Assess the sensitivity of files accessible via the web root to understand potential data exposure.

What to do and how to stay safe: DirectoryPress

• Immediately audit all WordPress installations to identify if DirectoryPress version 3.6.27 or earlier is active.
• Monitor server access logs for suspicious queries that attempt to include external or local files.
• Restrict file permissions on the server to minimise the impact if an inclusion attack succeeds.
• Once the vendor provides an update, apply the patch promptly to resolve the unauthenticated access risk.

Step-by-step guide: Virtual Patching: Benefits, Limits and When to Use It

General security guidance from the TechWire Beat newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Which versions of DirectoryPress are affected by CVE-2026-62032?

All versions of the DirectoryPress plugin up to and including 3.6.27 are affected by this vulnerability.

What is the severity rating for CVE-2026-62032?

The National Vulnerability Database rates CVE-2026-62032 as Critical with a CVSS score of 9.8.

Does exploiting this vulnerability require authentication?

No, the vulnerability is described as an unauthenticated Local File Inclusion, meaning no login is required.