DirectoryPress EUVD-2026-96467

Exploitation requires a publicly reachable WordPress installation running the DirectoryPress plugin at version 3.6.27 or earlier, with the vulnerable file-inclusion endpoint accessible (no authentication needed per PR:N). The specific vulnerable parameter/endpoint is not named in the provided data and must be taken from the Patchstack advisory. Limiting factors: the attack surface exists only on sites that have this particular commercial plugin installed and active; the plugin's modest deployment footprint, rather than any configuration prerequisite, is the primary constraint on real-world exploitability. Whether the LFI escalates beyond file disclosure to code execution depends on server conditions (readable/writable log or session files, PHP wrapper availability) that are not confirmed in the input.

The input CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, base 9.8) describes a fully remote, unauthenticated, low-complexity flaw with no user interaction - the strongest possible exploitability profile. However, the signals partially conflict: the vulnerability is described as 'Local File Inclusion' and carries an 'Information Disclosure' tag, which normally implies a confidentiality-dominant impact (file read), yet the vector rates Integrity and Availability as High. CWE-98 (improper control of filename for include/require in PHP) does provide a credible path from LFI to remote code execution (e.g., log poisoning, PHP wrappers, or session/file upload chaining), which would justify the High I/A ratings, but the provided data does not confirm that an RCE chain was demonstrated - verify the full impact with Patchstack. No EPSS score, no CISA KEV listing, and no public POC are present in the input, so there is no evidence of active or at-scale exploitation. Net assessment: this is a genuinely attractive target on paper (unauthenticated + network + default-reachable WordPress endpoint), but the absence of KEV/EPSS/POC signals, combined with the relatively niche footprint of the affected plugin, points to this being a patch-promptly priority rather than an in-the-wild emergency. Prioritize based on exposure (internet-facing WordPress sites running DirectoryPress) rather than on confirmed exploitation.

A remote, unauthenticated attacker sends a crafted HTTP request to a vulnerable DirectoryPress endpoint on a public WordPress site, supplying a manipulated file-path parameter that the plugin passes to a PHP include/require call. This lets the attacker read sensitive local files such as wp-config.php (database credentials, auth salts) and, if the LFI can be chained with log/session poisoning typical of CWE-98, potentially achieve code execution. No public exploit code was identified in the provided data, so any attack would require the adversary to independently develop the request.