CVE-2026-62032

Summary

The DirectoryPress plugin allows unauthenticated users to include arbitrary local files through a vulnerable parameter, potentially leading to remote code execution or sensitive data exposure. This critical vulnerability affects versions up to 3.6.27.

Exploitability

Exploitation is straightforward with no authentication required, though it may need knowledge of the target's file system structure to maximize impact.

Blast radius

The vulnerability could affect a large number of WordPress sites running the DirectoryPress plugin, potentially exposing sensitive files or enabling full server compromise.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to DirectoryPress version 3.6.28 or later to remediate this vulnerability.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.