DirectoryPress – Business Directory And Classified Ad Listing Security & Risk Analysis

The DirectoryPress plugin, in version 3.6.27, exhibits a mixed security posture. While it demonstrates good practices in output escaping (88% properly escaped) and includes a significant number of nonce and capability checks (48 and 49 respectively), several concerning areas require attention. The static analysis reveals a substantial attack surface with 77 AJAX handlers, 22 of which lack authentication checks. Furthermore, the presence of 6 high-severity taint flows and a notable percentage of SQL queries (78%) not using prepared statements pose significant risks.

The plugin's vulnerability history is also a cause for concern, with 8 known CVEs, including a critical one. The types of past vulnerabilities, such as Missing Authorization, CSRF, Unrestricted Uploads, SQL Injection, and XSS, align with the risks identified in the static analysis, particularly the unprotected AJAX handlers and unsanitized flows. The fact that the last vulnerability was in late 2025, while the current version is 3.6.27, could suggest potential unpatched vulnerabilities or a recent significant overhaul. The plugin's reliance on the Select2 bundled library could also introduce risks if it's outdated.

In conclusion, while DirectoryPress v3.6.27 has some strengths in output handling and general security checks, the large number of unprotected AJAX endpoints, high-severity taint flows, and historical vulnerability patterns indicate a need for significant security improvements. The high percentage of raw SQL queries and the presence of dangerous functions like unserialize warrant immediate investigation and remediation.