What is the CVSS score of CVE-2026-104397?

CVE-2026-104397 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.2%.

Name Directory CVE-2026-104397

EUVD-2026-92320 MEDIUM

Missing Authorization (CWE-862)

2026-10-05 Patchstack

GHSA-4g8x-82h6-7m76

WordPress Authentication Bypass Wordpress Plugin Name Directory

5.3

CVSS 3.1 · Vendor: Patchstack

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Identify site running Name Directory ≤1.34.2
Exploit

Send crafted unauthenticated request
Execution

Invoke protected shortcode/endpoint lacking authorization
Impact

Retrieve unauthorized directory data

Vulnerability Assessment

Weakness	CWE CWE-862 OWASP Top 10:2025 A01:2025 - Broken Access Control ASVS 5.0 V8 - Authorization Authorization checks on every request MITRE ATT&CK 1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. Sign in to read
Exploitation Conditions	No special configuration is required beyond having the Name Directory plugin (version n/a through 1.34.2) installed and active on a WordPress site; the CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates remote, unauthenticated exploitation with no user interaction against default installs. The practical limiting factors are the narrow impact (low confidentiality only, no integrity or availability) and the plugin's limited deployment footprint - exploitation yields unauthorized access to directory data exposed via the affected shortcode rather than site compromise. Upgrading past 1.34.2 removes the exposure.
Impact	This is a moderate-severity Missing Authorization flaw (CWE-862) in the Name Directory WordPress plugin, scored CVSS 5.3 with vector AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N - remote, low-complexity, unauthenticated, but limited to low confidentiality impact with no integrity or availability effect. The Patchstack reference titles this an 'arbitrary shortcode execution vulnerability,' which aligns with broken access control allowing an unauthenticated actor to invoke plugin functionality (shortcode rendering) they should not reach; the low C impact suggests the practical outcome is unauthorized information disclosure rather than code execution on the host. No EPSS score, CISA KEV listing, or public POC was supplied in the input, so there is no signal of active exploitation or weaponization. The signals are internally consistent (unauthenticated network vector matches a missing-authorization WordPress issue), but the overall priority is tempered: the C:L/I:N/A:N impact and modest plugin footprint make this a routine patch-when-convenient item rather than an emergency, absent exploitation evidence. SSVC-style framing: exploitation none-observed, automatable likely (unauthenticated web request), technical impact partial.
Exploit ScenarioDerived	An unauthenticated attacker sends a crafted HTTP request to a WordPress site running Name Directory ≤1.34.2, invoking a plugin shortcode or endpoint without the authorization check that should gate it. This lets them trigger directory functionality and read data they should not have access to. No public exploit code was identified at time of analysis, though the low attack complexity and lack of authentication make exploitation straightforward.

This Month Plan within 30 days. Why: MEDIUM severity (CVSS 4.0-6.9).

No patch listed yet 0.2% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Oct 05, 2026

Missing authorization in the WordPress Name Directory plugin (through version 1.34.2) lets remote, unauthenticated attackers reach functionality and directory data that should require higher privileges or proper access-control checks. The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N reflects low-complexity, unauthenticated exploitation against default installs, with impact confined to low confidentiality loss and no integrity or availability effect, so the realistic outcome is unauthorized disclosure of directory entries rather than site takeover. No public exploit code has been identified at time of analysis and there is no CISA KEV listing; the primary practical exposure is limited to sites running the vulnerable plugin.

RemediationAI

No fixed version number is documented in the available advisory data for CVE-2026-104397, so the immediate action is to upgrade the Name Directory plugin beyond 1.34.2 as soon as a patched release is published, after checking the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/name-directory/vulnerability/wordpress-name-directory-plugin-1-34-2-arbitrary-shortcode-execution-vulnerability?_s_id=cve for the vendor-confirmed fixed release; until then, treat 1.34.2 and earlier as vulnerable. Where an upgrade is not immediately possible, deactivate the Name Directory plugin if its directory functionality is not business-critical - this fully removes exposure but disables the feature for legitimate users. As a narrower compensating control, restrict access to the pages and endpoints that render the plugin's shortcode output via server-level rules or a WAF that requires authentication for those paths, accepting that this will also block anonymous visitors who legitimately use the public directory. Because the assessed impact is limited to low confidentiality loss with no integrity or availability effect, prioritization can follow routine plugin-update cadence rather than emergency change procedures, but the update should still be applied promptly given the unauthenticated, no-interaction exploitation profile.

Affected VersionsENISA

Name Directory 0 ≤1.34.2

Affected Packages

euvd name_directory no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

The flaw is a CWE-862 Missing Authorization condition in the Name Directory plugin for WordPress, tracked as CVE-2026-104397. The CPE entry cpe:2.3:a:jeroen_peters:name_directory:*:*:*:*:*:*:*:* confirms that all released versions up to and including 1.34.2 are in scope. WordPress plugins commonly expose custom functionality through shortcodes and AJAX/REST handlers; where such handlers omit a capability check or nonce validation, requests from unauthenticated visitors are processed with the site's own privileges. The supplied advisory reference, whose URL slug refers to 'arbitrary shortcode execution' for Name Directory 1.34.2, indicates the missing control is tied to how the plugin processes shortcode-driven input rather than to a memory-safety or injection flaw - the exposed behavior is the ability to trigger protected plugin logic without authorization, consistent with the assessed vector showing only a low confidentiality impact (C:L) and no integrity or availability change. The CVSS vector (PR:N, UI:N, AV:N, AC:L) establishes that exploitation requires no authentication and no victim interaction, while the S:U scope and unchanged I/A metrics bound the damage to reading data the attacker should not be able to access.

Know when Name Directory gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (Patchstack) PRIMARY 5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

vuln.today AI 5.3 MEDIUM

Unauthenticated remote web request (AV:N/AC:L/PR:N/UI:N) against a missing-authorization check; impact is unauthorized data disclosure only, so C:L and I:N/A:N.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

DescriptionCVE.org

Missing Authorization vulnerability in Jeroen Peters Name Directory name-directory allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Name Directory: from n/a through 1.34.2.

Threat Intelligence Overview

EPSS Score

0.2%

Top 88% exploitable

Prevalence

Low

niche WordPress directory plugin with modest install base

Data Quality

6 sources

Confidence: High

EUVD

NVD

CVE.org

EPSS

Vulnrichment CIRCL

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity MEDIUM

CISA KEV No

Public POC No

EPSS 0.2%

Patch available No

Active threat No

Deciding rule

MEDIUM severity (CVSS 4.0-6.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.