CVE-2026-104397 Jeroen Peters CVE debrief

Who should care

Defenders and administrators using the Name Directory plugin for WordPress should assess their exposure and verify the configuration of access control security levels.

Why it matters

Defenders should care about CVE-2026-104397 because it affects the Name Directory plugin for WordPress, potentially allowing for security incidents due to incorrectly configured access control security levels. Verification and updates are necessary to address this vulnerability.

• Verification of access control security levels is necessary to prevent potential security incidents.
• Defenders should prioritize updating to version 1.34.2 or later to address the vulnerability.

Technical summary

The Name Directory plugin for WordPress has a Missing Authorization vulnerability, which allows for Exploiting Incorrectly Configured Access Control Security Levels. This issue affects versions from n/a through 1.34.2. The vulnerability arises from inadequate authorization checks, potentially enabling attackers to perform actions they should not be able to. This could lead to security incidents if the plugin's access control security levels are not correctly configured. Defenders should prioritize verifying the configuration of access control security levels for

Defensive priority

Defenders should prioritize verifying the configuration of access control security levels for the Name Directory plugin, especially in environments where the plugin is used.

Recommended defensive actions

• Verify the configuration of access control security levels for the Name Directory plugin
• Check for updates to the Name Directory plugin to ensure version 1.34.2 or later is used
• Monitor for potential security incidents related to this vulnerability

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including its CVSS score and affected versions. However, additional information on exploitation or impact is not available.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.