WPTasty Business Directory CVE-2026-62097

Exploitation requires an authenticated session with high privileges (PR:H) on a WordPress site running the WPTasty Business Directory plugin version 6.4.27 or earlier, with access to the specific vulnerable input handled by the plugin. The injection is blind, so no direct output is returned - the attacker must use inference techniques (boolean/time-based), which raises effort though not enough to change AC. Limiting factors: the elevated privilege requirement means the attacker must already control a privileged account (insider or post-compromise), no user interaction is needed (UI:N), and the specific vulnerable parameter/endpoint is not documented in available data.

This is a plausible but not urgent priority. The CVSS 3.1 base score of 7.6 is driven by network attack vector (AV:N), low complexity (AC:L), a scope change (S:C), and high confidentiality impact (C:H) from blind SQL injection, but it is meaningfully constrained by PR:H - exploitation requires high-level (likely administrator or comparable elevated) privileges on the WordPress site. No EPSS score, no CISA KEV listing, and no public POC were provided in the intelligence, so exploitation status is: no public exploit identified at time of analysis. The high privilege requirement plus absence of any exploitation signal places this well below internet-facing unauthenticated SQLi in real-world urgency; it is a real integrity/confidentiality risk in multi-user or agency-managed WordPress installations where the attacker already holds a privileged account, but it is not a mass-exploitation candidate. One point to verify: Patchstack assigns S:C (scope change) which is common for their SQLi ratings on the shared database, but the practical impact is bounded to the site's own database; treat the scope-change contribution to the score with mild skepticism. No SSVC decision data was supplied.

An attacker holding a privileged WordPress account (e.g. administrator or a role able to reach the affected Business Directory admin/AJAX endpoint) submits crafted input into a vulnerable parameter that is concatenated into an SQL query. Because the flaw is blind, the attacker infers data through boolean/time-based responses to progressively extract database contents such as user credentials and hashes. No public exploit code was identified, and the high privilege requirement limits this to insiders or attackers who have already compromised a privileged account.