CVE-2026-3489: DirectoryPress WordPress SQLi Vulnerability

CVE-2026-3489 Overview

The DirectoryPress – Business Directory And Classified Ad Listing plugin for WordPress contains a SQL Injection vulnerability in the packages parameter. This security flaw exists in versions up to and including 3.6.26 due to insufficient escaping on the user-supplied parameter and lack of sufficient preparation on the existing SQL query. The vulnerability enables unauthenticated attackers to append additional SQL queries into already existing queries, which can be leveraged to extract sensitive information from the database.

Critical Impact

Unauthenticated attackers can exploit this SQL Injection vulnerability to extract sensitive data from WordPress databases, potentially compromising user credentials, personal information, and other confidential business data stored by the DirectoryPress plugin.

Affected Products

• DirectoryPress – Business Directory And Classified Ad Listing plugin for WordPress versions up to and including 3.6.26
• WordPress installations utilizing vulnerable DirectoryPress plugin versions
• Websites with DirectoryPress-managed business directories and classified ad listings

Discovery Timeline

• 2026-04-16 - CVE CVE-2026-3489 published to NVD
• 2026-04-16 - Last updated in NVD database

Technical Details for CVE-2026-3489

Vulnerability Analysis

This vulnerability is classified as CWE-89 (SQL Injection), one of the most critical web application security flaws. The DirectoryPress plugin fails to properly sanitize user input passed through the packages parameter before incorporating it into SQL queries. This architectural weakness allows attackers to manipulate the SQL statement structure and inject malicious queries.

The attack can be executed remotely over the network without requiring any authentication or user interaction. An attacker exploiting this vulnerability gains unauthorized read access to confidential database contents, though the vulnerability does not directly enable data modification or system availability impacts.

Root Cause

The root cause of CVE-2026-3489 lies in the improper handling of user-supplied input within the packages parameter. The plugin developers failed to implement proper input validation and parameterized queries (prepared statements). Instead of using WordPress's $wpdb->prepare() function to safely escape user input, the code directly concatenates user-supplied data into SQL query strings, creating an injection point that attackers can exploit.

Attack Vector

The vulnerability is exploitable via network-based attacks targeting the packages parameter. Attackers can craft malicious HTTP requests containing SQL injection payloads in this parameter. Since no authentication is required, any remote attacker can attempt exploitation against vulnerable WordPress installations.

The attack typically involves:

1. Identifying WordPress sites running vulnerable DirectoryPress versions
2. Crafting requests with SQL injection payloads in the packages parameter
3. Using techniques like UNION-based or blind SQL injection to extract database contents
4. Exfiltrating sensitive data including user credentials, emails, and business information

The vulnerability mechanism involves insufficient escaping of user input in the packages parameter, allowing attackers to break out of the intended SQL query context and inject arbitrary SQL commands. For technical implementation details, refer to the WordPress Plugin Changeset and the Wordfence Vulnerability Report.

Detection Methods for CVE-2026-3489

Indicators of Compromise

• Unusual database queries containing SQL syntax patterns in web server logs targeting DirectoryPress endpoints
• HTTP requests with suspicious characters in the packages parameter such as single quotes, UNION statements, or SQL comments
• Unexpected database read operations or data exports from WordPress tables
• Error messages in logs indicating SQL syntax errors from malformed injection attempts

Detection Strategies

• Implement Web Application Firewall (WAF) rules to detect SQL injection patterns in the packages parameter
• Monitor web server access logs for requests containing SQL injection signatures targeting DirectoryPress plugin routes
• Deploy SentinelOne Singularity Platform to detect anomalous database query patterns and potential data exfiltration attempts
• Use WordPress security plugins with real-time vulnerability scanning to identify outdated DirectoryPress installations

Monitoring Recommendations

• Enable detailed logging for all DirectoryPress plugin activities and database interactions
• Configure alerts for unusual query volumes or patterns against WordPress database tables
• Implement database activity monitoring to detect unauthorized SELECT queries against sensitive tables
• Regularly review access logs for reconnaissance activity targeting WordPress plugin endpoints

How to Mitigate CVE-2026-3489

Immediate Actions Required

• Update DirectoryPress plugin to the latest patched version immediately
• Audit WordPress database for signs of unauthorized data access or extraction
• Review web server logs for evidence of exploitation attempts against the packages parameter
• Consider temporarily disabling the DirectoryPress plugin until patching is complete on production sites

Patch Information

A security patch addressing this SQL Injection vulnerability is available through the WordPress plugin repository. The fix implements proper input sanitization and prepared statements for the packages parameter. Administrators should update to the latest version of DirectoryPress that addresses CVE-2026-3489. Details of the code changes can be reviewed in the WordPress Plugin Changeset.

Workarounds

• Deploy a Web Application Firewall (WAF) with rules to block SQL injection attempts targeting the packages parameter
• Implement server-level input validation to filter malicious SQL syntax from incoming requests
• Restrict access to DirectoryPress functionality to authenticated users only where business requirements permit
• Use database-level access controls to limit the WordPress database user's permissions to minimum required operations

# WordPress WAF configuration example for ModSecurity
# Add to .htaccess or ModSecurity configuration
SecRule ARGS:packages "@rx (?i)(union|select|insert|update|delete|drop|truncate|exec|declare)" \
    "id:100001,phase:2,deny,status:403,msg:'SQL Injection attempt blocked in DirectoryPress packages parameter'"