CVE-2026-27386: 
WordPress vulnerability analysis and mitigation

CVE-2026-27386 is a Missing Authorization vulnerability in the DesignThemes Directory Addon plugin for WordPress, classified under CWE-862. It allows unauthenticated remote attackers to exploit incorrectly configured access control security levels, potentially leading to unauthorized data or content manipulation. The vulnerability affects all versions of the plugin up to and including version 1.8. It was published on March 5, 2026, with the CVE assigned by Patchstack. The CVSS v3.1 base score is 7.5 (High), as assessed by Patchstack (Patchstack).

The root cause is a Missing Authorization flaw (CWE-862) in the DesignThemes Directory Addon WordPress plugin, where certain plugin functionality lacks proper capability or permission checks before execution. This allows an unauthenticated network-based attacker to invoke restricted actions without any authentication or user interaction, exploiting incorrectly configured access control levels. The attack vector is network-accessible, requires low complexity, and no privileges or user interaction are needed. No public proof-of-concept code has been identified at this time (Patchstack).

Successful exploitation primarily impacts integrity, as the CVSS vector indicates a high integrity impact with no confidentiality or availability impact. An unauthenticated attacker could perform unauthorized actions within the WordPress site — such as modifying directory listings, entries, or plugin-managed content — without any credentials. The scope is limited to the affected WordPress installation, but unauthorized content modification could undermine site trustworthiness or enable further abuse of the directory functionality (Patchstack).

No public exploit code or active in-the-wild exploitation has been reported for CVE-2026-27386 as of the available data. The EPSS score is approximately 0.017% (0.000170), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been identified (Patchstack).

Users should update the DesignThemes Directory Addon plugin to a version beyond 1.8 if a patched release is available from the plugin vendor or the WordPress plugin repository. If no patched version is yet available, site administrators should consider deactivating or removing the plugin until a fix is released. Restricting access to the WordPress admin panel and monitoring for unauthorized changes to directory listings or plugin-managed content is also advisable (Patchstack).