What is the CVSS score of CVE-2026-66661?

CVE-2026-66661 has a CVSS 3.1 base score of 7.7 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L. EPSS exploitation probability: 0.3%.

Which versions of Directories Pro are affected by CVE-2026-66661?

The Directories Pro WordPress plugin (versions ≤2.0.5) contains a privilege escalation vulnerability allowing authenticated subscriber-level users to gain elevated permissions, enabling unauthorized…

How to fix or mitigate CVE-2026-66661?

Within 24 hours, audit all WordPress installations to identify Directories Pro deployments and their versions; if not operationally critical, disable the plugin immediately to eliminate the attack vector. Over the next 7 days, monitor Patchstack and the plugin's official repository for a patched version (currently unavailable), document which business functions depend on this plugin, and implement interim compensating controls below. By day 30, either deploy an updated plugin version once released by the vendor or transition to an alternative directory listing solution that provides equivalent functionality without this vulnerability.

Directories Pro CVE-2026-66661

EUVD-2026-57899 HIGH

Incorrect Privilege Assignment (CWE-266)

2026-08-13 Patchstack

GHSA-m27g-4x2p-7v8m

WordPress Privilege Escalation Wordpress Plugin Directories Pro

7.7

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

7.7 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L

vuln.today AI

8.3 HIGH

Subscriber account is a required prerequisite (PR:L); open registration is common enough on directory sites to treat AC:L; no scope change occurs.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

Low

Lifecycle Timeline

Analysis Generated

Aug 13, 2026 - 14:26 vuln.today

CVE Published

Aug 13, 2026 - 13:37 cve.org

HIGH 7.7

DescriptionCVE.org

Subscriber Privilege Escalation in Directories Pro <= 2.0.5 versions.

AnalysisAI

Privilege escalation in the Directories Pro WordPress plugin (versions <= 2.0.5) allows a subscriber-level authenticated user to gain higher-level privileges within the WordPress installation. Reported by Patchstack and classified under CWE-266 (Incorrect Privilege Assignment), this flaw exposes sites using the plugin for directory listings to unauthorized data access and content manipulation. No public exploit code or CISA KEV listing has been identified at time of analysis, though the network-accessible attack surface warrants prompt patching.

Technical ContextAI

Directories Pro (CPE: cpe:2.3:a:onokazu:directories_pro:*:*:*:*:*:*:*:*) is a premium WordPress plugin by Onokazu (SabaiApps) used to build structured directory listing sites. The root cause is CWE-266: Incorrect Privilege Assignment, meaning the plugin fails to properly enforce role-based capability checks when a low-privileged subscriber account performs certain actions. In WordPress, subscribers have minimal permissions - any code path that promotes their effective capabilities without server-side authorization validation constitutes this flaw class. The vulnerability is accessible over the network as a standard HTTP request to the WordPress installation.

RemediationAI

Update the Directories Pro plugin to a version beyond 2.0.5 - consult the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/directories-pro/vulnerability/wordpress-directories-pro-plugin-2-0-5-privilege-escalation-vulnerability?_s_id=cve and the plugin's official changelog for the confirmed patched release version, which was not independently confirmed in the available data. As an interim workaround, disable open subscriber registration (Settings > General > Membership in WordPress) to eliminate the ability for unauthenticated visitors to create subscriber accounts, which directly limits the attack surface - note this may affect legitimate user onboarding workflows. Additionally, audit existing subscriber-level accounts for unauthorized privilege changes as a detection measure.