PT-2026-20329 · WordPress · Business Directory Plugin – Easy Listing Directories

Sein Linn · CVE-2026-2576 · Published 2026-02-18 · Updated 2026-02-23

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Business Directory Plugin – Easy Listing Directories for WordPress versions prior to 6.4.3

Description The Business Directory Plugin – Easy Listing Directories for WordPress is susceptible to time-based SQL Injection. This is due to inadequate escaping of user-supplied input and insufficient preparation of existing SQL queries. The payment parameter is the entry point for this issue, potentially allowing unauthenticated attackers to inject additional SQL queries to extract sensitive information from the database.

Recommendations Update to version 6.4.3 or later. As a temporary workaround, restrict access to the payment parameter.

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2026-2576

Affected Products

Business Directory Plugin – Easy Listing Directories

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2026-2576 · Security Note
• https://plugins.trac.wordpress.org/browser/business-directory-plugin/tags/6.4.21/includes/db/class-db-query-set.php#L37 · Note
• https://twitter.com/CVEarity/status/2024048205932171330 · Twitter Post
• https://plugins.trac.wordpress.org/browser/business-directory-plugin/tags/6.4.21/includes/controllers/pages/class-checkout.php#L126 · Note
• https://twitter.com/cracbot/status/2025888423366828195 · Twitter Post
• https://wordfence.com/threat-intel/vulnerabilities/id/d8ec7d25-1574-416c-b5fd-3a71b1cc09d2?source=cve · Note
• https://plugins.trac.wordpress.org/changeset/3463307/business-directory-plugin/trunk/includes/db/class-db-query-set.php · Note
• https://twitter.com/CVEnew/status/2023995917687226803 · Twitter Post