Arbitrary Directory Deletion in Connections Business Directory by WordPress

CVE-2024-12885

Summary

The Connections Business Directory plugin for WordPress has a vulnerability that allows authenticated attackers with Administrator-level access to delete any directory on the server. This stems from a lack of proper file path validation when attempting to delete connections image directories, potentially exposing critical data and disrupting service.

References