External risk intelligence

Directory Pro SQL Injection Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2026-66649

The vulnerability affects a WordPress plugin which is typically deployed as part of a public-facing web application. Directory plugins are designed to be accessible to visitors over the internet to search or interact with content, making the vulnerable code path commonly reachable from the public web.

SQL Injection

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical security issue has been identified in Directory Pro, a WordPress plugin, that could allow unauthorized access to your data if exploited. This vulnerability, related to SQL injection, affects unauthenticated users and is present in versions up to 2.5.8. The main concern at this stage is confirming whether this plugin is used within your organization and, if so, to what extent.

Allows unauthorized data access.
Affects public-facing website components.
Confirm relevance and exposure of this plugin.

Attack Path

How an attacker could exploit the issue

An unauthenticated attacker could exploit this vulnerability by sending specially crafted input to a public-facing web application. This could allow them to inject malicious SQL code into the application's database queries, potentially leading to unauthorized access or modification of sensitive data.

Entry Condition: No authentication required.
Trigger Point: Sending crafted input to the application.
Resulting Risk: Unauthorized data access or modification.

Live Threat

Current exploitation, exposure, and threat context

Unauthenticated SQL injection in Directory Pro could allow an attacker to access or modify sensitive data stored in the application's database. This could occur when the application improperly handles user input, leading to the execution of arbitrary SQL commands. The potential impact ranges from unauthorized data disclosure to a denial of service.

Database contents and configuration data.
Via unauthenticated network requests.
Unauthorized access to sensitive information.

Operational Fix

Recommended remediation, mitigation, and detection steps

This unauthenticated SQL injection vulnerability in Directory Pro impacts web applications using the plugin, likely making the application owners and infrastructure teams responsible for remediation. The first practical step is to identify all instances of Directory Pro within your environment, assess their exposure and criticality, and then plan remediation or mitigation strategies.

Application owners should own this issue.
Verify all Directory Pro instances and exposure.
Plan remediation or mitigation actions.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Directory Pro?

Directory Pro is a WordPress plugin used to create and manage searchable directory listings on a website. It allows site administrators to organize business or user data so that visitors can browse, filter, and search through content directly within the browser.

What does CVE-2026-66649 mean for my database security?

This vulnerability is classified as a SQL Injection (CWE-89). It means the plugin fails to properly sanitize user-supplied data before including it in database queries. An attacker can leverage this flaw to manipulate those queries, potentially reading or modifying information stored in your application's database.

How is this SQL injection triggered?

An attacker triggers this by sending specially crafted input through a web request to the vulnerable plugin. Because the issue does not require the attacker to have an account or be logged in, it can be initiated by anyone with network access to the site. Regular, legitimate interactions with the site's intended search features do not trigger this vulnerability.

Is my site likely to be reached by an attacker?

Halo Surface Signal indicates that because Directory Pro is designed to be interacted with by visitors over the internet, it is often deployed on public-facing web applications. This architecture makes the vulnerable code path inherently reachable from the public web, increasing the relevance of this issue for any internet-accessible site running the plugin.

What should I do if I use Directory Pro?

Your first step is to conduct an inventory to locate every instance of the Directory Pro plugin within your environment. Once identified, evaluate the criticality of the data associated with those sites. Coordinate with your application owners to prioritize these instances for updates or temporary mitigation while you wait for a formal patch.

References

patchstack.com/database/wordpress/plugin/directory-pro/vulnerability…

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.