First day on Intigriti: our agent harness found and proved a remote code execution bug, paid €3,000.

CVE-2026-66661

HighCVSS 7.7/10Last modified Oct 24, 2026

Description

Subscriber Privilege Escalation in Directories Pro <= 2.0.5 versions.

Metrics

CVSS 3.1 7.7/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L

Weakness enumeration

Affected software

Vendor	Product	Versions
Onokazu	Directories Pro	<= 2.0.5

References

https://patchstack.com/database/wordpress/plugin/directories-pro/vulnerability/wordpress-directories-pro-plugin-2-0-5-privilege-escalation-vulnerability?_s_id=cve

Timeline

Published: Aug 13, 2026
Last modified: Oct 24, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-666629.8Unauthenticated Privilege Escalation in Frontend Admin by DynamiApps <= 3.29.10 versions.CVE-2026-666637.1Unauthenticated Cross Site Scripting (XSS) in WP Data Access <= 5.5.79 versions.CVE-2026-666647.1Unauthenticated Cross Site Scripting (XSS) in SEO Plugin by Squirrly SEO <= 14.2.0 versions.CVE-2026-6666510.0Unauthenticated Arbitrary File Upload in Type Hub <= 2.0.6 versions.CVE-2026-666666.9Insertion of Sensitive Information Into Sent Data vulnerability in Automattic WordPress allows Retrieve Embedded Sensitive Data. This issue CVE-2026-666677.1Unauthenticated Cross Site Scripting (XSS) in Templately <= 3.7.1 versions.CVE-2026-666688.5Subscriber SQL Injection in Community by PeepSo <= 9.0.5.2 versions.CVE-2026-66674.3PgBouncer before 1.25.2 did not perform an appropriate authorization check for the KILL_CLIENT admin command. All users with access to the a CVE-2026-666708.1Unauthenticated Local File Inclusion in Måne <= 1.7 versions.CVE-2026-666718.1Unauthenticated Local File Inclusion in Verdure Core <= 1.2 versions.CVE-2026-666729.8Unauthenticated PHP Object Injection in Flatastic <= 2.0 versions.CVE-2026-666737.1Unauthenticated Cross Site Scripting (XSS) in Flatastic <= 2.0 versions.

CVE-2026-66661: High severity, CVSS 7.7 | Vulnix