CVE-2026-66661

This CVE exposes a privilege escalation in Directories Pro where a subscriber-level account can invoke functions reserved for editors or administrators. The attack vector runs through an AJAX handler or internal API function that processes directory submissions without verifying the caller's capability—the plugin accepts user-generated content but fails to check current_user_can() before executing privileged operations on that data. What makes this significant is the pattern, not the instance. WordPress plugins that handle user submissions routinely create a cognitive gap: developers secure the admin panel and form rendering, but leave the data-processing endpoints without capability checks because the code "looks like" it's handling subscriber input. The plugin knows the data came from a subscriber, but the save/publish function it calls was written for editors. This boundary exists in the developer's mental model but not in the code. The CVSS of 7.7 reflects moderate complexity and real impact—but the true blast radius exceeds what CVSS captures. If the plugin has 10,000 installations with an average of 50 subscriber accounts each, you're looking at 500,000 concurrent attack surfaces. Every subscriber on every affected site can simultaneously attempt privilege escalation. This isn't a vulnerability exploited by one attacker against one target; it's a mass-activation event the moment exploitation becomes public. Your immediate actions: verify you're running Directories Pro 2.0.6 or later, audit server logs for POST requests to wp-admin/admin-ajax.php with action parameters matching 'directories_pro_*' originating from subscriber accounts, and treat any unpatched installation as already compromised—the window between patch availability and CVE publication means some sites have been exposed longer than the disclosure timeline suggests. The deeper concern: this is likely one of several authorization gaps in the same plugin. The vulnerable handler was probably written early in the plugin's lifecycle when it handled less sensitive operations, then expanded without re-auditing the authorization model. Assume adjacent code paths—bulk operations, import/export utilities, data processing functions—carry similar gaps until proven otherwise.

Reviewed through automated stages and approved by a human before publication.