CVE-2023-37967: Medium Access Flaw in DirectoryPress Plugin

CVE-2023-37967 is a medium severity (CVSS 6.5) missing authorization flaw in the DirectoryPress plugin from Designinvento, in versions through 3.6.2. The vector needs no account at all, and the impact is limited changes to data and availability. Update the plugin and confirm the fixed release in the vendor notes.

What's affected

The NVD record lists DirectoryPress as affected "from n/a through 3.6.2", which is Patchstack wording for every release up to and including 3.6.2. The record scores the flaw 6.5 with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L. The weakness is tracked as CWE-862 (missing authorization).

The vector (PR:N, UI:N) says an anonymous visitor can reach the flaw over the network, with low integrity (I:L) and low availability (A:L) impact. The Patchstack reference title also calls it an unauthenticated broken access control vulnerability, so the two agree. The CVE description adds that it allows exploiting incorrectly configured access control security levels.

The record names no fixed version, and the Patchstack page it links to could not be retrieved when we reviewed it (Patchstack blocked our request). The CVE is not flagged in CISA KEV in the record, and nothing we read says it is exploited in the wild. For the fixed release, check the vendor changelog or the Patchstack entry.

How to check if you're exposed

If you run WP-CLI, list the installed version and status of the plugin:

wp plugin list --fields=name,version,status,update

Look for DirectoryPress in the output. Anything at 3.6.2 or lower is in the affected range. In the dashboard the same information is under Plugins, Installed Plugins. On a fleet of sites, run the command per site or through your management tool, and include staging and forgotten test copies.

You can also check your dependency manifests and images. A free in-browser scan at gold.safeguard.sh/scan takes a package.json, a requirements.txt or an SBOM and shows known CVEs, though WordPress plugins are usually tracked by the CMS rather than a package manager, so keep a separate list of them.

What to do now

1. List every WordPress site you run and note whether DirectoryPress is installed and at what version.
2. Update DirectoryPress to the newest release the vendor offers. If the update is behind a license, renew it or plan the change, because the old version stays vulnerable.
3. If you cannot update today, deactivate the plugin on sites where it is not needed, or restrict access to the affected features with a web application firewall rule from your provider.
4. Review user accounts and recent changes on any site that ran the affected version for a while, and remove accounts you do not recognise.
5. Add the plugin to a watch list so the next advisory reaches you the day it is published.

Why it matters

A directory plugin lets visitors and members submit and manage listings. That means many endpoints that handle writes, and each needs a check on who is calling. A missing check on any one of them gives anonymous users a way to do something members or administrators should control.

The impact is moderate, since the record rates confidentiality as none. But an unauthenticated flaw on a public site is reachable by anyone with an internet connection, which is why a medium score still deserves a prompt update.

Quick check

Sources

• Patchstack entry (linked from the NVD record; it could not be retrieved when we reviewed it)
• CVE-2023-37967 on Gold

Last reviewed: 19 October 2026.