CVE-2026-104397: WordPress Name Directory plugin <= 1.34.2 - Arbitrary Shortcode Execution vulnerability
Missing Authorization vulnerability in Jeroen Peters Name Directory name-directory allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Name Directory: from n/a through 1.34.2.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
wordpress/name-directoryto a version that resolves this vulnerability.Fixed in 1.34.3
Event History
Frequently Asked Questions
Who can exploit this issue?
The CVSS vector indicates that exploitation can be performed remotely without authentication or user interaction. The available data does not identify any additional attacker prerequisites.
What is the security impact?
The issue allows arbitrary shortcode execution and is rated medium severity with a CVSS score of 5.3. The stated impact is limited confidentiality impact; integrity and availability impacts are not indicated.
Which installations are affected?
Name Directory versions through 1.34.2 are affected. The provided information does not state whether any particular WordPress configuration, shortcode setting, or deployment scenario is required.