CVE-2026-57339
MediumCVSS 6.5Summary
The Business Directory plugin version 6.4.23 and earlier contains a vulnerability allowing unauthenticated attackers to bypass access controls. This flaw enables unauthorized access to administrative functions without requiring authentication.
Risk Assessment
The risk involves potential takeover of the business directory by an unauthenticated attacker, leading to modification, deletion, or theft of business data and compromise of site integrity.
Recommendation
Immediately update the Business Directory plugin to the latest available version that addresses this vulnerability. If an update is not possible, temporarily disable the plugin until a patch is applied.
Other vulnerabilities in Business Directory
See all- CVE-2026-57328Medium
The Business Directory plugin version 6.4.22 and earlier is vulnerable to Cross Site Scripting (XSS) from a subscriber level. An authenticated subscriber can inject malicious JavaScript code.
- CVE-2026-57326Medium
The Business Directory plugin version 6.4.22 and earlier contains an unauthenticated Cross Site Scripting (XSS) vulnerability. An attacker can inject malicious JavaScript code without requiring authentication.
- CVE-2026-28004High
Unauthenticated Cross Site Scripting (XSS) in Business Directory versions up to 6.4.25. An attacker can inject malicious script without authentication.
- CVE-2026-61959Medium
Cross Site Scripting (XSS) vulnerability in Business Directory versions up to 6.4.24 allows a Subscriber user to inject malicious script.
Original NVD description (English source)
Unauthenticated Broken Access Control in Business Directory <= 6.4.23 versions.