WordPress Plugin Vulnerabilities

Business Directory Plugin – Easy Listing Directories for WordPress < 6.4.24 - Missing Authorization

Description

The Business Directory Plugin – Easy Listing Directories for WordPress plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in versions up to, and including, 6.4.23. This makes it possible for unauthenticated attackers to perform an unauthorized action.

Affects Plugins

Plugin icon
business-directory-plugin
Fixed in 6.4.24

References

CVE
CVE-2026-57339
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/7253cc66-3c57-4ba6-98dc-f7620c577f97

Classification

Type
NO AUTHORISATION
OWASP top 10
A5: Broken Access Control
CWE
CWE-862
CVSS
5.3 (medium)

Miscellaneous

Original Researcher
John Umoru
Verified
No
WPVDB ID
6112d21e-f3a9-46d7-87d9-09f1970bdc7d

Timeline

Publicly Published
2026-06-29 (about 27 days ago)
Added
2026-07-07 (about 19 days ago)
Last Updated
2026-07-07 (about 19 days ago)

Other

Published
Title
Published
2025-02-19
Title
LTL Freight Quotes – GlobalTranz Edition < 2.3.13 - Missing Authorization to Unauthenticated Settings Update
Published
2025-10-29
Title
Debug Log Viewer < 2.0.4 - Missing Authorization
Published
2026-07-15
Title
The Cache Purger < 2.3.21 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Log Deletion via 'the_log_purge' Parameter
Published
2023-09-12
Title
WPvivid Backup Plugin < 0.9.91 - Missing Authorization via 'start_staging' and 'get_staging_progress'
Published
2026-06-30
Title
Visualizer < 4.0.4 - Missing Authorization to Unauthenticated Sensitive Information Disclosure via /visualizer/v1/action/{chart}/{type}/ REST Endpoint