What is the CVSS score of CVE-2026-39534?

CVE-2026-39534 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.3%.

Which versions of WP Directory Kit are affected by CVE-2026-39534?

WP Directory Kit WordPress plugin versions 1.5.0 and earlier contain an unauthenticated access control bypass allowing remote attackers to access restricted functionality and data without…

How to fix or mitigate CVE-2026-39534?

Within 24 hours: Inventory all WordPress instances for WP Directory Kit presence; disable the plugin if not business-critical or migrate to alternative solutions. Within 7 days: Implement Web Application Firewall (WAF) or firewall rules to restrict access to plugin endpoints; enable detailed logging of access attempts to wp-content/plugins/wp-directory-kit/. Within 30 days: Monitor Patchstack and plugin vendor for security updates; deploy patched version immediately upon release; conduct access log forensics for evidence of prior exploitation.

WP Directory Kit CVE-2026-39534

EUVD-2026-36963 HIGH

Missing Authorization (CWE-862)

2026-06-15 Patchstack

GHSA-v63q-fwcp-fph6

Authentication Bypass Wp Directory Kit

7.5

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

7.5 HIGH

Network-reachable WordPress plugin endpoint with missing authorization (PR:N, AC:L, UI:N); description limits impact to broken access control, so C:H but I:N/A:N.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 15, 2026 - 22:18 vuln.today

DescriptionCVE.org

Unauthenticated Broken Access Control in WP Directory Kit <= 1.5.0 versions.

AnalysisAI

Unauthenticated broken access control in the WP Directory Kit WordPress plugin (versions ≤ 1.5.0) allows remote attackers to bypass authorization checks on plugin endpoints and access functionality or data that should require authentication. The flaw was disclosed via Patchstack and tracked as EUVD-2026-36963; no public exploit identified at time of analysis, and the issue is not listed in CISA KEV.

Technical ContextAI

WP Directory Kit is a WordPress plugin used to build directory-style listing sites (members, businesses, locations). The CPE cpe:2.3:a:wp_directory_kit:wp_directory_kit:*:*:*:*:*:*:*:* covers all plugin versions up to 1.5.0. The root-cause class is CWE-862 (Missing Authorization), meaning one or more plugin AJAX actions, REST endpoints, or admin-post handlers fail to verify the caller’s capability (e.g. missing current_user_can()) or nonce, so requests proceed regardless of the requester’s identity. In WordPress plugins this pattern typically arises when handlers are registered on the no-priv AJAX hook or on unauthenticated REST routes without a permission_callback.

RemediationAI

Upstream fix available per the Patchstack advisory, but no specific vendor-released patched version is cited in the supplied data - released patched version not independently confirmed; administrators should upgrade WP Directory Kit to the latest available release newer than 1.5.0 from the WordPress.org plugin repository and confirm the installed version is above 1.5.0 after update. Until the upgrade is applied, restrict access to the WordPress site (IP allow-listing wp-admin/admin-ajax.php and the plugin's REST namespace at the WAF or reverse proxy) and consider temporarily deactivating the WP Directory Kit plugin - note that deactivation will break directory pages and any shortcodes the plugin renders, and IP restrictions on admin-ajax.php can disrupt legitimate front-end AJAX features of other plugins. Monitor the Patchstack advisory URL above for the fixed version number and apply it as soon as published.