Description

Unauthenticated Broken Access Control in Business Directory <= 6.4.26 versions.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-09-03T17:17:26.787Z",
  "pubdate": "2026-09-03T17:17:26.787Z",
  "executiveSummary": "The Business Directory plugin for WordPress, in versions 6.4.26 and earlier, contains a critical broken access control vulnerability. This security flaw allows unauthenticated remote attackers to bypass authorization mechanisms, potentially gaining unauthorized access to sensitive functionality or data managed by the plugin.\nThe vulnerability originates from a lack of sufficient access control checks within the plugin's core architecture. By sending specially crafted requests, an unauthorized actor can interact with administrative or restricted functions that were intended to be protected by authentication or privilege-based constraints.\nThe risk implication is high, as the vulnerability does not require prior knowledge of legitimate user credentials or established sessions. An attacker can exploit this remotely over the network with minimal technical requirements. The impact includes, but is not limited to, unauthorized data exposure, modification of directory entries, or the potential for further system compromise depending on the specific functions exposed through the insecure interface.\nOrganizations utilizing the affected versions of the Business Directory plugin are advised to restrict access or apply updates immediately to mitigate the risk of exploitation.",
  "technicalDetails": "The vulnerability is rooted in a failure to properly implement authorization checks within the Business Directory plugin's request handling logic. In affected versions (<= 6.4.26), the application processes user requests without consistently validating the session's authenticity or the requester's privilege level before executing sensitive backend operations.\nThe root cause typically stems from the use of insecure request handlers or hooks that lack a robust 'current_user_can()' check or an equivalent authorization gate. Consequently, functions intended for privileged administrators are exposed to the public web interface, allowing any unauthenticated network actor to invoke these methods.\nThe attack flow follows a predictable pattern: 1) The attacker identifies the endpoint associated with the vulnerable component, often mapped to administrative or data-management actions within the plugin's internal routing system. 2) The attacker crafts an HTTP request (typically GET or POST) targeting this endpoint. 3) Because the server-side code fails to verify the requester's identity, the plugin's backend logic proceeds to execute the requested command or process the data operation as if it originated from an authorized user. 4) The server returns the requested data or confirms the action, completing the exploitation cycle.\nThis vulnerability is classified as an improper access control issue (CWE-285 or related CWE-862). The lack of input-specific authorization allows for the unauthorized retrieval of private directory information or the illicit modification of business listings. Because the flaw exists within the plugin's processing layer, it is reachable via standard web requests without the need for specialized payloads, such as SQL injection or Cross-Site Scripting (XSS).\nPost-exploitation, the impact can be severe. Depending on the functionality exposed, an attacker could potentially delete directory records, modify listing configurations, or extract proprietary business data. In environments where the plugin provides administrative dashboard access, this vulnerability may serve as a critical pivot point for deeper unauthorized access into the WordPress ecosystem. The exposure is universal for all instances where the plugin is active and accessible via the public network, making it a high-priority target for automated scanning and exploitation."
}