CVE-2026-3489

CVE-2026-3489 is a SQL Injection vulnerability in the DirectoryPress – Business Directory And Classified Ad Listing WordPress plugin affecting versions 3.6.26 and earlier. The flaw exists in the 'packages' parameter due to insufficient input escaping and improper SQL query preparation, allowing unauthenticated attackers to inject malicious SQL commands. This vulnerability enables unauthorized extraction of sensitive data from affected website databases. The vulnerability has a CVSS score of 7.5 (HIGH) with a network-based attack vector requiring no special privileges or user interaction, indicating a relatively low barrier to exploitation. The attack has low complexity and results in a high confidentiality impact, as adversaries can extract sensitive information from the database, though integrity and availability are not affected. There is currently no evidence of active exploitation in the wild, with the EPSS score of 0.00032 indicating this CVE ranks higher in severity than only a small percentage of known vulnerabilities. The vulnerability is not listed on the CISA Known Exploited Vulnerabilities catalog and shows no community activity on the Hot List, suggesting limited public attention and exploit availability at this time.