What is the CVSS score of CVE-2026-57707?

CVE-2026-57707 has a CVSS 3.1 base score of 9.3 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L. EPSS exploitation probability: 0.4%.

Which versions of Simple Business Directory Pro are affected by CVE-2026-57707?

QuantumCloud's Simple Business Directory Pro WordPress plugin (all versions through 15.9.4) contains an unauthenticated SQL injection vulnerability enabling credential theft and database…

How to fix or mitigate CVE-2026-57707?

Within 24 hours: immediately disable and remove Simple Business Directory Pro from affected WordPress instances, or if operationally critical, implement WAF rules blocking SQL injection patterns targeting the plugin. Within 7 days: audit all systems that ran the plugin for compromise indicators including unusual database queries, exported credential records, and access logs. Within 30 days: monitor vendor advisories and Patchstack for patch availability; test any released patch in staging and deploy to production only after validation.

Simple Business Directory Pro CVE-2026-57707

EUVD-2026-43363 CRITICAL

SQL Injection (CWE-89)

2026-07-13 Patchstack

WordPress SQLi Wordpress Plugin Simple Business Directory Pro Quantumcloud

9.3

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

9.3 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L

vuln.today AI

7.1 HIGH

Remote low-complexity SQLi with the low-privileged access typical of directory plugins (PR:L); high confidentiality data theft, limited integrity via write injection, no scope change assumed.

3.1 AV:N/AC:L/PR:L/UI:N/S:N/C:H/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

None

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 13, 2026 - 10:50 vuln.today

CVE Published

Jul 13, 2026 - 08:41 cve.org

CRITICAL 9.3

DescriptionCVE.org

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in quantumcloud Simple Business Directory Pro simple-business-directory-pro allows SQL Injection.This issue affects Simple Business Directory Pro: from n/a through <= 15.9.4.

AnalysisAI

SQL injection in QuantumCloud's Simple Business Directory Pro WordPress plugin (all versions through 15.9.4) allows remote attackers to inject crafted SQL into backend database queries, enabling extraction of sensitive data such as user credentials and stored directory records. Patchstack rates it critical (CVSS 9.3) with a network attack vector and no authentication indicated in the supplied vector; there is no public exploit identified at time of analysis and it is not listed in CISA KEV. The high score and scope-change flag make it a priority for any site running this plugin.

Technical ContextAI

The affected component is Simple Business Directory Pro, a commercial WordPress plugin (CPE cpe:2.3:a:quantumcloud:simple_business_directory_pro) that lets site owners publish searchable business/listing directories. The root cause is CWE-89 (Improper Neutralization of Special Elements used in an SQL Command): user-controllable input reaches a database query without proper parameterization or escaping, so SQL metacharacters are interpreted as query structure rather than data. In WordPress plugins this class of flaw typically arises from directory search/filter, listing-ID, or AJAX handler parameters passed into $wpdb queries via string concatenation instead of $wpdb->prepare().

RemediationAI

No vendor-released patch identified at time of analysis; the latest referenced version (15.9.4) is itself affected, so no fixed version number can be cited from the input. Monitor the QuantumCloud vendor page and the Patchstack advisory (https://patchstack.com/database/Wordpress/Plugin/simple-business-directory-pro/vulnerability/wordpress-simple-business-directory-pro-plugin-15-9-4-sql-injection-vulnerability?_s_id=cve) and upgrade to a patched release as soon as one is published. Until then, deploy a WordPress WAF (Patchstack or equivalent) with virtual patching for this CVE, which blocks malicious query strings with minimal functional impact; restrict or disable the plugin's public directory search/submission endpoints if they are not business-critical, at the cost of losing front-end directory search; and if the directory need not be public, gate it behind authentication or IP allow-listing, which blocks legitimate anonymous visitors. As a stopgap, deactivating the plugin entirely eliminates exposure but removes directory functionality.