CVE-2026-27396: 
WordPress vulnerability analysis and mitigation

CVE-2026-27396 is a Missing Authorization vulnerability in the e-plugins Directory Pro WordPress plugin that allows unauthenticated attackers to exploit incorrectly configured access control security levels. It affects Directory Pro versions from n/a through 2.5.6. The vulnerability was published on March 5, 2026, and assigned by Patchstack. It carries a CVSS v3.1 base score of 7.3 (High) (Feedly, Patchstack).

The root cause is classified as CWE-862 (Missing Authorization), meaning the plugin fails to properly verify whether a requesting user has the necessary permissions before performing sensitive operations. The attack vector is network-based, requires no authentication, no user interaction, and low attack complexity, making it trivially exploitable by any remote attacker. The vulnerability falls under the broader category of Broken Access Control, where improperly configured security levels allow unauthorized actions to be performed on the affected WordPress plugin (Feedly, Patchstack).

Successful exploitation results in low-level impacts across confidentiality, integrity, and availability — an attacker could read sensitive directory data, modify plugin content or settings, and potentially disrupt plugin functionality. Because no authentication is required, any internet-facing WordPress site running Directory Pro ≤ 2.5.6 is at risk. The scope is limited to the affected system (unchanged scope), but unauthorized manipulation of directory listings could expose user data or enable further abuse of the plugin's functionality (Feedly).

The EPSS score for CVE-2026-27396 is approximately 0.017% (0.000170), indicating a low probability of exploitation in the wild at this time. No public proof-of-concept exploit code, active in-the-wild exploitation, or threat actor attribution has been reported. The vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. However, the lack of authentication requirement and low attack complexity make it a straightforward target if exploitation details become public (Feedly).

Users should update the Directory Pro plugin to a version beyond 2.5.6 as soon as a patched release is made available by e-plugins. In the interim, site administrators should consider deactivating the plugin if it is not critical to operations, or restricting access to the WordPress site via firewall rules or IP allowlisting. Monitoring WordPress admin logs for unexpected access to plugin-related endpoints is also advisable (Patchstack).