Insecure Direct Object Reference in Business Directory Plugin for WordPress by WordPress
CVE-2024-13887
5.3MEDIUM
Key Information:
- Vendor
WordPress
- Vendor
- CVE Published:
- 13 March 2025
What is CVE-2024-13887?
The Business Directory Plugin for WordPress is susceptible to an Insecure Direct Object Reference vulnerability due to inadequate validation on a user-controlled key within the 'ajax_listing_submit_image_upload' function. This flaw allows attackers without authentication to upload arbitrary images to existing listings, potentially compromising the integrity and safety of the site. Websites utilizing versions up to and including 6.4.14 of the plugin need to implement corrective measures to protect against unauthorized image uploads.
Affected Version(s)
Business Directory Plugin – Easy Listing Directories for WordPress * <= 6.4.14