CVE-2026-39566

CVE-2026-39566 is an information disclosure vulnerability in Designinvento DirectoryPress versions 3.6.26 and earlier that exposes sensitive system information to unauthorized users. The vulnerability allows attackers to retrieve embedded sensitive data through the affected application, representing a weakness in the product's access controls and data protection mechanisms. The vulnerability carries a CVSS score of 4.0 (Medium severity) with a network-based attack vector, high attack complexity, and no privileges or user interaction required. The impact is limited to confidentiality, with potential exposure of low-sensitivity information, and the vulnerability has a controlled scope. The EPSS score of 0.00036 indicates minimal real-world exploitation probability compared to other CVEs. There is currently no evidence of active exploitation, and the vulnerability is not tracked on the CISA Known Exploited Vulnerabilities list or included on any active hot lists. Community attention to this issue appears minimal, suggesting either low awareness or limited threat in operational environments. Organizations should prioritize patching based on their specific use of DirectoryPress, though the moderate severity and low exploitation likelihood suggest this is not an immediate critical threat.