CVE-2026-27387: DirectoryPress Auth Bypass Vulnerability

CVE-2026-27387 Overview

A Missing Authorization vulnerability has been identified in the DirectoryPress WordPress plugin developed by designinvento. This Broken Access Control flaw allows attackers to exploit incorrectly configured access control security levels, potentially enabling unauthorized access to restricted functionality within WordPress sites utilizing the DirectoryPress directory plugin.

Critical Impact

Attackers may bypass authorization checks to access or modify protected resources, potentially compromising directory listings, user data, or administrative functions within the DirectoryPress plugin.

Affected Products

• DirectoryPress WordPress Plugin versions through 3.6.26
• WordPress installations with DirectoryPress plugin enabled

Discovery Timeline

• 2026-02-19 - CVE CVE-2026-27387 published to NVD
• 2026-02-19 - Last updated in NVD database

Technical Details for CVE-2026-27387

Vulnerability Analysis

This vulnerability is classified under CWE-862 (Missing Authorization), indicating that the DirectoryPress plugin fails to perform adequate authorization checks before allowing access to certain functionality. The absence of proper authorization controls means that authenticated or unauthenticated users may be able to access features or data that should be restricted based on user roles or permissions.

In WordPress plugin contexts, Missing Authorization typically manifests when AJAX handlers, REST API endpoints, or other action hooks do not verify user capabilities before executing privileged operations. The DirectoryPress plugin, which provides directory listing functionality for WordPress sites, appears to expose certain administrative or privileged functions without proper capability checks.

Root Cause

The root cause of this vulnerability lies in missing or inadequate authorization verification within the DirectoryPress plugin codebase. Specifically, certain plugin functions that handle sensitive operations fail to implement WordPress capability checks (such as current_user_can()) before proceeding with the requested action. This design flaw allows users without appropriate permissions to invoke functionality that should be restricted to administrators or authorized roles.

Attack Vector

An attacker can exploit this vulnerability by directly accessing plugin endpoints or AJAX handlers that lack proper authorization checks. The attack does not require special authentication in scenarios where the vulnerable functions are accessible to unauthenticated users, or may require only basic subscriber-level authentication if the functions check for logged-in status but not specific capabilities.

The exploitation typically involves:

1. Identifying vulnerable AJAX actions or REST endpoints exposed by the DirectoryPress plugin
2. Crafting requests to these endpoints without possessing the required user role
3. Executing unauthorized operations such as modifying directory listings, accessing private data, or altering plugin settings

For technical details on the specific vulnerable functions and exploitation methodology, refer to the Patchstack Vulnerability Advisory.

Detection Methods for CVE-2026-27387

Indicators of Compromise

• Unexpected modifications to DirectoryPress listings or settings without corresponding admin activity
• Unusual AJAX requests to DirectoryPress plugin endpoints from non-administrative user sessions
• Database changes to DirectoryPress-related tables without corresponding legitimate administrative actions
• Access logs showing direct requests to wp-admin/admin-ajax.php with DirectoryPress action parameters from unauthorized IP addresses

Detection Strategies

• Monitor WordPress audit logs for DirectoryPress-related actions performed by non-administrative users
• Implement Web Application Firewall (WAF) rules to detect and alert on suspicious plugin endpoint access patterns
• Review access logs for abnormal request volumes to DirectoryPress AJAX handlers
• Deploy file integrity monitoring to detect unauthorized changes to DirectoryPress plugin files or configuration

Monitoring Recommendations

• Enable comprehensive WordPress activity logging using security plugins
• Configure alerts for permission-related anomalies in DirectoryPress operations
• Implement rate limiting on AJAX endpoints to detect automated exploitation attempts
• Regularly audit user roles and capabilities to ensure principle of least privilege

How to Mitigate CVE-2026-27387

Immediate Actions Required

• Update DirectoryPress plugin to the latest version that addresses this vulnerability
• Audit DirectoryPress settings and listings for any unauthorized modifications
• Review user accounts for any suspicious privilege escalation or unauthorized access
• Temporarily disable the DirectoryPress plugin if an update is not immediately available and the functionality is non-critical

Patch Information

Site administrators should check for updates to the DirectoryPress plugin through the WordPress admin dashboard or via the official WordPress plugin repository. Consult the Patchstack Vulnerability Advisory for details on patched versions and remediation guidance.

Workarounds

• Restrict access to the WordPress admin area (/wp-admin/) using IP-based access controls if possible
• Implement a Web Application Firewall (WAF) to filter malicious requests targeting DirectoryPress endpoints
• Limit user registration and enforce strict role-based access controls on the WordPress site
• Consider disabling the vulnerable plugin until an official patch is available if the directory functionality is not business-critical

# Configuration example - Restrict wp-admin AJAX access via .htaccess
# Add to WordPress root .htaccess file

<Files admin-ajax.php>
    <RequireAny>
        Require ip 192.168.1.0/24
        Require ip 10.0.0.0/8
    </RequireAny>
</Files>