PT-2026-20329 · WordPress · Business Directory Plugin – Easy Listing Directories

Sein Linn · Publicado 2026-02-18 · Atualizado 2026-02-23 · CVE-2026-2576

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Business Directory Plugin – Easy Listing Directories for WordPress versions prior to 6.4.3

Description The Business Directory Plugin – Easy Listing Directories for WordPress is susceptible to time-based SQL Injection. This is due to inadequate escaping of user-supplied input and insufficient preparation of existing SQL queries. The payment parameter is the entry point for this issue, potentially allowing unauthenticated attackers to inject additional SQL queries to extract sensitive information from the database.

Recommendations Update to version 6.4.3 or later. As a temporary workaround, restrict access to the payment parameter.

Correção

SQL injection

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

CVE-2026-2576

Produtos afetados

Business Directory Plugin – Easy Listing Directories

Referências · 8

• https://plugins.trac.wordpress.org/browser/business-directory-plugin/tags/6.4.21/includes/db/class-db-query-set.php#L37 · Nota
• https://twitter.com/CVEarity/status/2024048205932171330 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2026-2576 · Nota de Segurança
• https://plugins.trac.wordpress.org/browser/business-directory-plugin/tags/6.4.21/includes/controllers/pages/class-checkout.php#L126 · Nota
• https://twitter.com/cracbot/status/2025888423366828195 · Publicação no Twitter
• https://wordfence.com/threat-intel/vulnerabilities/id/d8ec7d25-1574-416c-b5fd-3a71b1cc09d2?source=cve · Nota
• https://plugins.trac.wordpress.org/changeset/3463307/business-directory-plugin/trunk/includes/db/class-db-query-set.php · Nota
• https://twitter.com/CVEnew/status/2023995917687226803 · Publicação no Twitter