Authorization Bypass Vulnerability in Business Directory Plugin for WordPress

CVE-2026-1656

What is CVE-2026-1656?

The Business Directory Plugin for WordPress is vulnerable to an authorization bypass due to a missing authorization check present in versions up to and including 6.4.20. This flaw allows unauthenticated attackers to manipulate arbitrary listings on the platform. By crafting specific requests to the wpbdp_ajax AJAX action and utilizing the listing ID, attackers can alter critical information such as titles, content, and email addresses of listings, significantly compromising the integrity and security of affected sites.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References