CVE-2026-62097
HighCVSS 7.6Summary
The Business Directory plugin (business-directory-plugin) in WPTasty contains a Blind SQL Injection vulnerability due to improper neutralization of special elements in an SQL command. The issue affects versions from n/a through 6.4.27.
Risk Assessment
An attacker can exploit blind SQL injection to read or modify database data, potentially leading to data confidentiality and integrity breaches.
Recommendation
Upgrade the Business Directory plugin to a version newer than 6.4.27 that includes the fix.
Other vulnerabilities in Business Directory
See all- CVE-2026-94173Medium
Business Directory plugin version 6.4.27 and earlier contains an Insecure Direct Object References (IDOR) vulnerability exploitable by contributors, allowing unauthorized access to resources.
- CVE-2026-57339Medium
The Business Directory plugin version 6.4.23 and earlier contains a vulnerability allowing unauthenticated attackers to bypass access controls. This flaw enables unauthorized access to administrative functions without requiring authentication.
- CVE-2026-57328Medium
The Business Directory plugin version 6.4.22 and earlier is vulnerable to Cross Site Scripting (XSS) from a subscriber level. An authenticated subscriber can inject malicious JavaScript code.
- CVE-2026-57326Medium
The Business Directory plugin version 6.4.22 and earlier contains an unauthenticated Cross Site Scripting (XSS) vulnerability. An attacker can inject malicious JavaScript code without requiring authentication.
- CVE-2026-84769Medium
The Business Directory plugin version 6.4.26 and earlier contains an unauthenticated Insecure Direct Object References (IDOR) vulnerability.
- CVE-2026-84758Medium
The Business Directory plugin versions up to 6.4.26 contain an unauthenticated broken access control vulnerability. An attacker can exploit this flaw to gain unauthorized access to protected features.
- CVE-2026-28004High
Unauthenticated Cross Site Scripting (XSS) in Business Directory versions up to 6.4.25. An attacker can inject malicious script without authentication.
- CVE-2026-61959Medium
Cross Site Scripting (XSS) vulnerability in Business Directory versions up to 6.4.24 allows a Subscriber user to inject malicious script.
- CVE-2025-67596Medium
The Business Directory plugin for WordPress (versions up to and including 6.4.19) contains a Cross-Site Request Forgery (CSRF) vulnerability. It allows an attacker to force an administrator to perform unwanted actions.
Original NVD description (English source)
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WPTasty Business Directory business-directory-plugin allows Blind SQL Injection.This issue affects Business Directory: from n/a through 6.4.27.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS