CVE-2026-3489

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

The DirectoryPress – Business Directory And Classified Ad Listing plugin for WordPress is vulnerable to SQL Injection via the 'packages' parameter in versions up to, and including, 3.6.26 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-89

Affected software

Vendor	Product	Versions
designinvento	DirectoryPress – Business Directory And Classified Ad Listing	<= 3.6.26

References

Timeline

Published: Apr 16, 2026
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-348906.5Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Mark O’Donnell MSTW League Manager all CVE-2026-348917.5Unauthenticated Sensitive Data Exposure in IDPay Payment Gateway for Woocommerce <= 2.2.5 versions.CVE-2026-348926.5Missing Authorization vulnerability in Rank Math SEO Rank Math SEO seo-by-rank-math allows Exploiting Incorrectly Configured Access Control CVE-2026-348938.1Unauthenticated Local File Inclusion in Thegov Core < 2.0.23 versions.CVE-2026-348948.1Unauthenticated Local File Inclusion in Integrio Core < 1.2.8 versions.CVE-2026-348958.1Unauthenticated Local File Inclusion in Softlab Core < 1.2.11 versions.CVE-2026-348967.5Cross-Site Request Forgery (CSRF) vulnerability in Analytify Under Construction, Coming Soon & Maintenance Mode allows Cross Site Request Fo CVE-2026-348976.5Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in David Lingren Media LIbrary Assistant CVE-2026-348987.5Unauthenticated Broken Access Control in Event Tickets Manager for WooCommerce <= 1.5.3 versions.CVE-2026-348995.3Missing Authorization vulnerability in Eniture technology LTL Freight Quotes – Worldwide Express Edition allows Exploiting Incorrectly Confi CVE-2026-349010.0picklescan before 1.0.4 fails to block pkgutil.resolve_name, allowing attackers to bypass the entire blocklist by resolving any dangerous fu CVE-2026-349007.1Unauthenticated Cross Site Scripting (XSS) in GiveWP <= 4.14.2 versions.