CVE-2026-3489

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-3489", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2026-03-03T16:06:12.476Z", "datePublished": "2026-04-16T11:21:21.179Z", "dateUpdated": "2026-04-16T14:05:03.740Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-16T11:21:21.179Z"}, "affected": [{"vendor": "designinvento", "product": "DirectoryPress \u2013 Business Directory And Classified Ad Listing", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "3.6.26", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The DirectoryPress \u2013 Business Directory And Classified Ad Listing plugin for WordPress is vulnerable to SQL Injection via the 'packages' parameter in versions up to, and including, 3.6.26 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database."}], "title": "DirectoryPress \u2013 Business Directory And Classified Ad Listing <= 3.6.26 - Unauthenticated SQL Injection via 'packages'", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/2e602223-8571-42e1-9b3f-e7cc51f8fa58?source=cve"}, {"url": "https://plugins.trac.wordpress.org/changeset/3474986/directorypress"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')", "cweId": "CWE-89", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "baseScore": 7.5, "baseSeverity": "HIGH"}}], "credits": [{"lang": "en", "type": "finder", "value": "Leonid Semenenko"}], "timeline": [{"time": "2026-03-04T22:30:23.000Z", "lang": "en", "value": "Vendor Notified"}, {"time": "2026-04-15T21:35:44.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-04-16T14:04:42.509065Z", "id": "CVE-2026-3489", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-16T14:05:03.740Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-3489", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-16T14:04:42.509065Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-16T14:04:56.217Z"}}], "cna": {"title": "DirectoryPress \u2013 Business Directory And Classified Ad Listing <= 3.6.26 - Unauthenticated SQL Injection via 'packages'", "credits": [{"lang": "en", "type": "finder", "value": "Leonid Semenenko"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 7.5, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"}}], "affected": [{"vendor": "designinvento", "product": "DirectoryPress \u2013 Business Directory And Classified Ad Listing", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "3.6.26"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2026-03-04T22:30:23.000Z", "value": "Vendor Notified"}, {"lang": "en", "time": "2026-04-15T21:35:44.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/2e602223-8571-42e1-9b3f-e7cc51f8fa58?source=cve"}, {"url": "https://plugins.trac.wordpress.org/changeset/3474986/directorypress"}], "descriptions": [{"lang": "en", "value": "The DirectoryPress \u2013 Business Directory And Classified Ad Listing plugin for WordPress is vulnerable to SQL Injection via the 'packages' parameter in versions up to, and including, 3.6.26 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-89", "description": "CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-16T11:21:21.179Z"}}}, "cveMetadata": {"cveId": "CVE-2026-3489", "state": "PUBLISHED", "dateUpdated": "2026-04-16T14:05:03.740Z", "dateReserved": "2026-03-03T16:06:12.476Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2026-04-16T11:21:21.179Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "DirectoryPress \u2013 Business Directory And Classified Ad Listing", "vendor": "designinvento", "versions": [{"lessThanOrEqual": "3.6.26", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The DirectoryPress \u2013 Business Directory And Classified Ad Listing plugin for WordPress is vulnerable to SQL Injection via the 'packages' parameter in versions up to, and including, 3.6.26 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database."}], "id": "CVE-2026-3489", "lastModified": "2026-06-17T10:43:40.147", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-3489", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-04-16T14:04:42.509065Z", "version": "2.0.3"}}]}, "published": "2026-04-16T12:16:08.373", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/changeset/3474986/directorypress"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/2e602223-8571-42e1-9b3f-e7cc51f8fa58?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-89"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,3.6.26]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "DirectoryPress \u2013 Business Directory And Classified Ad Listing", "source": "cna", "vendor": "designinvento"}, "product": "directorypress_\u2013_business_directory_and_classified_ad_listing", "vendor": "designinvento"}, {"configurations": [{"platform": null, "status": "unaffected", "versions": null}], "enrichment": {"confidence": 80.0, "confidence_source": "inferred", "scores": [{"score": 80.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "product": "wordpress", "vendor": "wordpress"}], "analysis": {"en": {"generated_at": "2026-04-17T03:25:44.136177+00:00", "value": {"mitigation_remediation": ["Upgrade the DirectoryPress plugin to a version newer than 3.6.26, ensuring that the update includes proper input sanitization and query parameterization.", "If no patch is available or upgrade is impractical, modify the plugin code to escape or parameterize the 'packages' input, or replace the vulnerable query with a prepared statement that disallows arbitrary SQL.", "Block or restrict access to the endpoint that processes the 'packages' parameter using web\u2011application firewalls or server configuration rules to deny unauthenticated requests.", "Implement routine database backups and enforce the principle of least privilege on database accounts used by WordPress to limit impact if an injection is attempted."], "summary": {"action": "Immediate Upgrade", "impact": "Unauthenticated SQL Injection with potential data exfiltration"}, "threat_synthesis": {"affected_systems": "The affected product is DirectoryPress \u2013 Business Directory And Classified Ad Listing from designinvento, with all published releases up to and including version 3.6.26 impacted. No newer version is listed in the data, so any installation of 3.6.26 or earlier must be considered vulnerable unless the vendor has issued a patch beyond this version.", "description_and_impact": "The vulnerability resides in the DirectoryPress WordPress plugin where the 'packages' parameter is concatenated directly into an SQL statement without proper escaping or parameterization. An attacker can inject arbitrary SQL into this parameter, causing adjacent queries to execute. Successful exploitation could allow extraction of sensitive data from the site\u2019s database, undermining confidentiality and potentially enabling further compromise.", "risk_and_exploitability": "The CVSS score of 7.5 indicates a high severity vulnerability that can be exploited over the web without authentication. EPSS is not available, and the issue is not catalogued in the KEV list, but the lack of required credentials and the potential for data extraction make it a significant risk. An unauthenticated attacker who can reach the affected endpoint can inject SQL statements and retrieve database contents, so the attack vector is likely via a standard HTTP request targeting the plugin\u2019s endpoint."}}}}, "created": "2026-04-16T18:58:38.009224+00:00", "updated": "2026-04-17T03:30:08.595747+00:00", "vendors": ["designinvento", "designinvento$PRODUCT$directorypress_\u2013_business_directory_and_classified_ad_listing", "wordpress", "wordpress$PRODUCT$wordpress"]}