CVE-2026-62032: DirectoryPress Path Traversal Vulnerability

CVE-2026-62032 Overview

CVE-2026-62032 is an unauthenticated Local File Inclusion (LFI) vulnerability affecting the DirectoryPress WordPress plugin in versions up to and including 3.6.27. The flaw is classified under CWE-98, covering improper control of filename for include/require statements in PHP programs. Remote attackers can abuse the vulnerable parameter to include arbitrary local files without authentication. Successful exploitation can lead to disclosure of sensitive configuration data, source code, or remote code execution when combined with attacker-controlled file uploads or log poisoning techniques. The vulnerability was published to the National Vulnerability Database (NVD) on October 10, 2026.

Critical Impact
Unauthenticated attackers can include arbitrary local files on the server, enabling disclosure of sensitive data and potential code execution against WordPress sites running DirectoryPress 3.6.27 or earlier.

Affected Products

DirectoryPress WordPress plugin versions <= 3.6.27
WordPress installations using the vulnerable DirectoryPress plugin
Any hosting environment running the affected plugin versions

Discovery Timeline

2026-10-10 - CVE-2026-62032 published to the National Vulnerability Database
2026-10-13 - Entry last modified in the NVD database

Technical Details for CVE-2026-62032

Vulnerability Analysis

The vulnerability resides in DirectoryPress plugin logic that passes user-supplied input into a PHP include, require, include_once, or require_once statement without proper sanitization. Attackers reach the vulnerable code path over the network without any authentication or user interaction. The CWE-98 classification confirms the root cause is improper control of a filename used in a PHP file-inclusion function.

Because the input is not restricted to an allowlist of expected files, attackers can traverse the filesystem using path manipulation sequences. Once a target file is included, PHP interprets its contents. Attackers can therefore read sensitive files such as wp-config.php or escalate the LFI to remote code execution by including attacker-controlled content from uploads, session files, or log files.

Root Cause

The root cause is unsanitized user input flowing directly into a PHP file inclusion function inside DirectoryPress. The plugin does not validate the parameter against an allowlist, does not normalize path separators, and does not restrict inclusion to a defined base directory. This violates the secure coding principle underlying CWE-98.

Attack Vector

Attackers send a crafted HTTP request to a DirectoryPress endpoint that accepts the vulnerable file parameter. No credentials or user interaction are required. The attacker supplies a path to a sensitive local file or to a file they can influence, and the server includes and executes it in the PHP context. Refer to the Patchstack advisory for DirectoryPress for technical details on the vulnerable request pattern.

Detection Methods for CVE-2026-62032

Indicators of Compromise

HTTP requests to DirectoryPress endpoints containing path traversal sequences such as ../, ..%2f, or encoded null bytes.
Requests referencing sensitive files like wp-config.php, /etc/passwd, or /proc/self/environ in query parameters.
Web server access logs showing repeated 200 responses to DirectoryPress URLs with unusual file path parameters.
Unexpected PHP errors in logs referencing include() or require() calls with user-controlled paths.

Detection Strategies

Deploy Web Application Firewall (WAF) rules that flag path traversal patterns in requests to WordPress plugin endpoints.
Correlate HTTP access logs with file-system reads of sensitive configuration files on the WordPress host.
Hunt for anomalous process execution originating from the PHP worker following suspicious inclusion requests.

Monitoring Recommendations

Monitor WordPress plugin directories for new or modified files that could indicate post-exploitation activity.
Alert on outbound network connections from the web server to uncommon destinations after inbound DirectoryPress requests.
Enable PHP error logging and ingest logs into a central SIEM for retrospective hunting against the Patchstack indicators.

How to Mitigate CVE-2026-62032

Immediate Actions Required

Identify every WordPress site running DirectoryPress and determine the installed version.
Disable the DirectoryPress plugin on any site running version 3.6.27 or earlier until a patched release is applied.
Review web server and WordPress logs for prior exploitation attempts referencing the vulnerable parameter.
Rotate credentials and secrets stored in wp-config.php if LFI exploitation is suspected.

Patch Information

Consult the Patchstack advisory for DirectoryPress for the current fixed version and vendor remediation guidance. Apply the vendor-supplied update as soon as it is available on all affected WordPress installations.

Workarounds

Deactivate and remove the DirectoryPress plugin until a patched version is installed.
Deploy WAF rules that block requests containing path traversal sequences targeting the vulnerable DirectoryPress endpoint.
Restrict PHP open_basedir to limit file inclusion to the WordPress root and uploads directories.
Enforce least-privilege filesystem permissions so the PHP process cannot read sensitive files outside the web root.

bash

# Example php.ini hardening to constrain file inclusion scope
open_basedir = "/var/www/html:/tmp"
allow_url_include = Off
allow_url_fopen = Off