PT-2026-20363 · WordPress · The Business Directory Plugin

Sein Linn · Publicado 2026-02-18 · Atualizado 2026-02-18 · CVE-2026-1656

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Média

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Business Directory Plugin for WordPress versions prior to 6.4.21

Description The Business Directory Plugin for WordPress is affected by an authorization bypass. A missing authorization check allows unauthenticated attackers to modify directory listings. Attackers can change listing details like titles, content, and email addresses by referencing the listing ID in requests to the wpbdp ajax API endpoint. The vulnerable parameter is the listing ID.

Recommendations Update to version 6.4.21 or later.

Correção

Missing Authorization

Enumeração de Fraquezas

CWE-862

Identificadores relacionados

CVE-2026-1656

Produtos afetados

The Business Directory Plugin

Referências · 9

• https://t.me/cveNotify/152296 · Publicação no Telegram
• https://plugins.trac.wordpress.org/changeset/3452627/business-directory-plugin/tags/6.4.21/includes/controllers/pages/class-submit-listing.php · Nota
• https://t.me/CVEtracker/44957 · Publicação no Telegram
• https://plugins.trac.wordpress.org/browser/business-directory-plugin/trunk/includes/helpers/class-authenticated-listing-view.php#L20 · Nota
• https://wordfence.com/threat-intel/vulnerabilities/id/f894ce75-168c-4baa-8cae-d2e7f1a0a9ab?source=cve · Nota
• https://plugins.trac.wordpress.org/browser/business-directory-plugin/tags/6.4.20/includes/helpers/class-authenticated-listing-view.php#L20 · Nota
• https://twitter.com/CVEnew/status/2024049104968380803 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2026-1656 · Nota de Segurança
• https://twitter.com/VulmonFeeds/status/2024130899256684629 · Publicação no Twitter