Description

Unauthenticated Insecure Direct Object References (IDOR) in Business Directory <= 6.4.26 versions.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-09-03T17:17:28.140Z",
  "pubdate": "2026-09-03T17:17:28.140Z",
  "executiveSummary": "The Business Directory plugin for WordPress, in versions 6.4.26 and below, is susceptible to an unauthenticated Insecure Direct Object Reference (IDOR) vulnerability. This security flaw arises from a failure to implement adequate access control checks on objects referenced via user-supplied identifiers. By manipulating these identifiers within incoming requests, an unauthenticated attacker can bypass authorization mechanisms to access, modify, or delete sensitive directory data that should be restricted.\nThe vulnerability poses a significant risk to data confidentiality and integrity. Successful exploitation allows unauthorized remote actors to perform actions reserved for privileged users without requiring authentication or session tokens. Given the nature of directory plugins, this may include the unauthorized disclosure of private business information, contact details, or administrative settings. The impact is critical as it leverages the lack of server-side validation to manipulate resources directly. Users are advised to limit exposure by applying available vendor patches or restricting access to the directory endpoints.",
  "technicalDetails": "The core of the vulnerability lies in the Business Directory plugin's request handling logic, which fails to verify the authorization of an unauthenticated user before processing actions related to specific directory objects. An IDOR condition exists when the application relies on predictable or sequential identifiers (such as database primary keys or object IDs) provided in parameters (e.g., GET/POST variables) without validating that the current user has explicit permission to interact with the specific object associated with that ID.\nThe attack flow begins when an unauthenticated actor identifies a request targeting a directory object, such as a business listing or a configuration parameter. Because the server-side code does not implement a security check to confirm user identity or role-based access control (RBAC) at the function level responsible for handling these objects, the application processes the request based solely on the user-provided ID. By simply modifying the parameter value (e.g., incrementing an integer ID), the attacker can access records belonging to other users or sensitive system objects.\nTechnically, the vulnerable component fails to perform an authorization check against the current user context. When an HTTP request is received, the plugin retrieves the object from the database based on the provided identifier. Because the plugin logic assumes that the requester is authorized simply because they are interacting with the application, it proceeds to execute sensitive functions—such as CRUD operations—on the target object. This bypasses the intended security boundary of the directory management system.\nPost-exploitation, an attacker can enumerate, retrieve, or manipulate data without authenticating. This includes the potential for unauthorized data exfiltration, the modification of listing details, or the deletion of directory content. The lack of authentication requirements means that the attack can be automated and performed over a public network, significantly increasing the risk of mass data compromise or unauthorized administrative control over directory entries."
}