First day on Intigriti: our agent harness found and proved a remote code execution bug in Odoo's program.

CVE-2026-66649

CriticalCVSS 9.3/10Last modified Aug 20, 2026

Description

Unauthenticated SQL Injection in Directory Pro <= 2.5.8 versions.

Metrics

CVSS 3.1 9.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L

Weakness enumeration

Affected software

Vendor	Product	Versions
e-plugins	Directory Pro	<= 2.5.8

References

https://patchstack.com/database/wordpress/plugin/directory-pro/vulnerability/wordpress-directory-pro-plugin-2-5-8-sql-injection-vulnerability?_s_id=cve

Timeline

Published: Aug 20, 2026
Last modified: Aug 20, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-66659.8The SCRAM code in PgBouncer before 1.25.2 did not check the return value of strlcat() correctly when building the contents of the SCRAM clie CVE-2026-666509.8Unauthenticated PHP Object Injection in FreightCo <= 1.1.15 versions.CVE-2026-666516.5Missing Authorization vulnerability in MultiVendorX MultiVendorX dc-woocommerce-multi-vendor allows Exploiting Incorrectly Configured Access CVE-2026-666525.4Cross-Site Request Forgery (CSRF) vulnerability in ThemeGoods Grand Tour allows Cross Site Request Forgery. This issue affects Grand Tour: CVE-2026-666538.1Unauthenticated Local File Inclusion in Barista <= 2.5.1 versions.CVE-2026-666546.0Subscriber Server Side Request Forgery (SSRF) in Vehica Core <= 1.0.104 versions.CVE-2026-666557.1Unauthenticated Cross Site Scripting (XSS) in MultiParcels Shipping For WooCommerce <= 1.30.36 versions.CVE-2026-666568.1Unauthenticated Local File Inclusion in Foton Core <= 1.1.1 versions.CVE-2026-666578.1Unauthenticated Local File Inclusion in Biagiotti Core <= 2.1.1 versions.CVE-2026-666588.5Subscriber SQL Injection in Reviewer <= 3.14.2 versions.CVE-2026-666599.3Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Essekia Tablesome Table allows Blind S CVE-2026-66667.5A possible null pointer reference in PgBouncer before 1.25.2 could lead to a crash, if a server sends an error response without SQLSTATE fie

CVE-2026-66649: Critical severity, CVSS 9.3 | Vulnix