CVE-2026-57707

CriticalCVSS 9.3

Published: 13/07/2026(UTC)Updated: 13/07/2026(UTC)Translated: 14/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.40%

32th percentile - higher than 32% of all known CVEs

Summary

The Simple Business Directory Pro WordPress plugin contains an SQL injection vulnerability in versions up to and including 15.9.4. An attacker can exploit improper neutralization of special elements in SQL commands.

Risk Assessment

The risk involves unauthorized database access, potential data leakage or modification, which could lead to full compromise of the WordPress site.

Recommendation

Immediately update the Simple Business Directory Pro plugin to the latest available version that fixes this vulnerability.

Original NVD description (English source)

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in quantumcloud Simple Business Directory Pro simple-business-directory-pro allows SQL Injection.This issue affects Simple Business Directory Pro: from n/a through <= 15.9.4.