PT-2026-20363 · WordPress · The Business Directory Plugin

Sein Linn · Published 2026-02-18 · Updated 2026-02-18 · CVE-2026-1656

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Business Directory Plugin for WordPress versions prior to 6.4.21

Description The Business Directory Plugin for WordPress is affected by an authorization bypass. A missing authorization check allows unauthenticated attackers to modify directory listings. Attackers can change listing details like titles, content, and email addresses by referencing the listing ID in requests to the wpbdp ajax API endpoint. The vulnerable parameter is the listing ID.

Recommendations Update to version 6.4.21 or later.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2026-1656

Affected Products

The Business Directory Plugin

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2026-1656 · Security Note
• https://t.me/cveNotify/152296 · Telegram Post
• https://plugins.trac.wordpress.org/changeset/3452627/business-directory-plugin/tags/6.4.21/includes/controllers/pages/class-submit-listing.php · Note
• https://t.me/CVEtracker/44957 · Telegram Post
• https://plugins.trac.wordpress.org/browser/business-directory-plugin/trunk/includes/helpers/class-authenticated-listing-view.php#L20 · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/f894ce75-168c-4baa-8cae-d2e7f1a0a9ab?source=cve · Note
• https://plugins.trac.wordpress.org/browser/business-directory-plugin/tags/6.4.20/includes/helpers/class-authenticated-listing-view.php#L20 · Note
• https://twitter.com/CVEnew/status/2024049104968380803 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2024130899256684629 · Twitter Post