External risk intelligence

DirectoryPress Local File Inclusion Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-62032

This vulnerability affects a WordPress plugin, which is a type of web application component. WordPress sites and their plugins are commonly deployed as internet-facing web applications, making the vulnerable code directly reachable via standard HTTP/HTTPS requests from the public internet.

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory concerns a critical vulnerability in DirectoryPress, a type of web application component. The issue allows unauthenticated local file inclusion, meaning an attacker could potentially access sensitive files on a server. Given its critical severity and network-exploitability, it warrants attention to confirm if your organization uses this technology and what the exposure might be.

Unauthenticated access to sensitive files.
Commonly used web component, potentially internet-facing.
Confirm usage and assess potential exposure.

Attack Path

How an attacker could exploit the issue

An unauthenticated attacker can exploit this vulnerability by submitting specially crafted input to the affected component. This could allow them to read sensitive files from the server's file system, leading to significant compromise of data and system integrity.

No authentication required.
Triggered by user input.
Read sensitive files.

Live Threat

Current exploitation, exposure, and threat context

Unauthenticated local file inclusion vulnerabilities, when present in web applications, can allow an attacker to access sensitive files on the server. This could potentially expose system information or other files that are not intended to be publicly accessible, depending on the application's configuration and the server's file structure.

Sensitive server files could be exposed.
Via specially crafted network requests.
Unauthorized information disclosure.

Operational Fix

Recommended remediation, mitigation, and detection steps

This unauthenticated Local File Inclusion vulnerability in DirectoryPress could allow for critical system compromise. Ownership typically lies with the application owner responsible for the WordPress site, supported by infrastructure and security teams for exposure assessment and remediation. The first practical step is to identify all instances of DirectoryPress, confirm their reachability and business criticality, and then engage the accountable owner to plan a response based on risk.

Application owners should prioritize this issue.
Verify all DirectoryPress instances and exposure.
Plan and coordinate remediation or mitigation.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is DirectoryPress?

DirectoryPress is a plugin for WordPress designed to help users build directory-style websites, such as business listings, classifieds, or job boards. It functions as a web application component that extends site capabilities, and like many WordPress plugins, it resides on the web server to process user interactions and manage data.

What does CVE-2026-62032 mean?

CVE-2026-62032 is a Local File Inclusion (LFI) vulnerability. This weakness, classified as CWE-98, occurs when software fails to properly sanitize user input before using it to access files. In this specific case, it allows an unauthorized person to trick the plugin into reading files from the server's local file system that they should not have access to.

How is this vulnerability triggered?

An attacker triggers this by sending a specially crafted network request to the vulnerable site. The flaw does not require the attacker to have a user account or any prior authorization to perform the request. It is important to note that simply visiting the site normally or performing standard administrative tasks does not trigger this issue.

Do I need to worry if my DirectoryPress site is internal?

Halo Surface Signal indicates that because this plugin is a web component, it is commonly exposed to the public internet. While an internet-facing site carries a higher risk of being reachable by anyone, any instance of DirectoryPress—regardless of whether it is internal or public—contains the flawed code and should be treated as a potential security concern.

How should I start responding to this?

The first step is to create an inventory of all WordPress sites within your environment to identify which ones have DirectoryPress installed. Once you have a list of affected instances, determine if they are reachable over the network and coordinate with the site owners to evaluate the risk and plan for necessary updates or mitigation.

References

patchstack.com/database/wordpress/plugin/directorypress/vulnerabilit…

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.