CVE-2026-62032

Deferred Deferred - Pending Action

Unauthenticated Local File Inclusion in DirectoryPress

Publication date: 2026-10-10

Last updated on: 2026-11-07

Assigner: Patchstack

Description

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Designinvento DirectoryPress directorypress allows PHP Local File Inclusion.This issue affects DirectoryPress: from n/a through 3.6.27.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-10

Last Modified

2026-11-07

Generated

2026-11-08

AI Q&A

2026-10-11

EPSS Evaluated

2026-11-07

NVD

CVE-2026-62032

EUVD

EUVD-2026-96467

Affected Vendors & Products

Vendor	Product	Version / Range
Designinvento	DirectoryPress	n/a

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-98	The PHP application receives input from an upstream component, but it does not restrict or incorrectly restricts the input before its usage in "require," "include," or similar functions.

Attack-Flow Graph

Executive Summary

CVE-2026-62032 is an unauthenticated Local File Inclusion (LFI) vulnerability in DirectoryPress versions 3.6.27 and below. It allows attackers to force a website to load unauthorized server files without needing prior access, potentially leading to a full site takeover.

Detection Guidance

Check if the DirectoryPress plugin version 3.6.27 or below is installed on your WordPress site. Look for unusual file access patterns or unauthorized file inclusions in server logs. No specific commands are provided in the resources.

Impact Analysis

This vulnerability can lead to unauthorized access to sensitive files on the server, enabling attackers to take over the entire website. Since it is unauthenticated, any unpatched website using DirectoryPress <= 3.6.27 is at high risk of exploitation.

Compliance Impact

Exploitation could result in unauthorized data access or theft, violating GDPR, HIPAA, or other regulations. This may lead to legal penalties, reputational damage, and loss of customer trust due to compromised sensitive data.

Mitigation Strategies

Immediately update the DirectoryPress plugin to the latest version if available. If no patch exists, apply Patchstack's temporary mitigation rule to block attacks. Contact your hosting provider or developer for assistance. Consider using Patchstack's automated vulnerability mitigation service.

Hi! I’m here to help you understand CVE-2026-62032. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...