Unauthenticated Access Control Vulnerability in Business Directory Plugin by WordPress

CVE-2026-57339

What is CVE-2026-57339?

CVE-2026-57339 is a serious vulnerability found in the Business Directory Plugin for WordPress, specifically affecting versions up to 6.4.23. This vulnerability is characterized as an unauthenticated broken access control issue, which allows attackers to exploit weaknesses in the plugin and gain unauthorized access to sensitive features or data. The Business Directory Plugin is commonly utilized by organizations to create directory listings on their WordPress sites, offering functionalities such as user submissions, category organization, and customizable listings.

The potential negative impact of this vulnerability is significant, as it could enable malicious actors to manipulate directory data, access confidential information, or even administer unauthorized changes to the plugin settings. Such exploitation could jeopardize the integrity of the entire WordPress site, potentially leading to data leaks, defacement, or unauthorized transactions, all of which could tarnish the reputation of an organization and result in financial losses.

Potential impact of CVE-2026-57339

1. Unauthorized Data Access: Attackers can exploit this vulnerability to access sensitive information stored within the Business Directory Plugin, potentially compromising user data and organizational records.

2. Data Manipulation: By gaining access to administrative functions, malicious users may alter or delete directory listings, leading to loss of important data or misinformation being displayed to users.

3. Reputational Damage: The exploitation of this vulnerability can result in significant harm to an organization’s reputation, especially if sensitive data breaches occur, impacting customer trust and driving users away.

References