Skip to main content

Business Directory Plugin CVE-2026-84769

| EUVDEUVD-2026-70577 MEDIUM
Authorization Bypass Through User-Controlled Key (CWE-639)
2026-09-03 Patchstack GHSA-9w4w-3jc8-f8mr
Authentication Bypass Business Directory WordPress Wordpress Plugin
6.5
CVSS 3.1 · Vendor: Patchstack
Share

Severity by source

Vendor (Patchstack) PRIMARY
6.5 MEDIUM
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
vuln.today AI
6.5 MEDIUM

Unauthenticated network-reachable IDOR with low complexity; impact bounded to directory listing data reads and writes, no availability effect.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
Low
Integrity
Low
Availability
None

Lifecycle Timeline

1
Analysis Generated
Sep 03, 2026 - 17:20 vuln.today

DescriptionCVE.org

Unauthenticated Insecure Direct Object References (IDOR) in Business Directory <= 6.4.26 versions.

AnalysisAI

Unauthenticated IDOR in the Business Directory WordPress plugin (versions <= 6.4.26) allows remote attackers to access or modify directory listing objects belonging to other users without authentication. The flaw stems from missing authorization checks on direct object references, enabling both unauthorized data reads and writes against business listing records. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
technique details hidden
Delivery
technique details hidden
Exploit
technique details hidden
Execution
technique details hidden
Impact
technique details hidden
Sign in to reveal

Vulnerability AssessmentAI

Exploitation No special conditions - remote unauthenticated exploitation against default configurations of Business Directory Plugin on any WordPress site running version 6.4.26 or earlier. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment CVSS 6.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N) accurately reflects a moderate risk: fully unauthenticated, no complexity or interaction required, but impact is bounded (low confidentiality, low integrity, no availability). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation Update the Business Directory Plugin to a version above 6.4.26 via the WordPress plugin dashboard or the plugin's official repository. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Business Directory

View all
CVE-2024-4443 CRITICAL POC
9.8 May 22

The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based

CVE-2023-5527 HIGH
7.4 Jun 18

The Business Directory Plugin plugin for WordPress is vulnerable to CSV Injection in versions up to, and including, 6.4.
CVE-2026-28004 HIGH
7.1 Aug 13

Unauthenticated XSS in the Business Directory WordPress plugin (versions ≤ 6.4.25, by Strategy11 Team) permits remote at
CVE-2026-61959 MEDIUM
6.5 Aug 06

Stored Cross-Site Scripting in the Business Directory WordPress plugin (versions up to and including 6.4.24) allows auth
CVE-2026-84758 MEDIUM
6.5 Sep 03

Broken access control in Business Directory WordPress plugin versions 6.4.26 and earlier exposes unauthenticated endpoin
CVE-2026-57339 MEDIUM
6.5 Jun 29

Broken Access Control in the Business Directory WordPress plugin (versions 6.4.23 and below) permits unauthenticated rem
CVE-2026-57328 MEDIUM
6.5 Jun 29

Cross-site scripting in the Business Directory WordPress plugin (versions 6.4.22 and earlier) allows authenticated subsc
CVE-2026-57326 MEDIUM
6.1 Jun 29

Unauthenticated cross-site scripting in the Business Directory WordPress plugin (versions <= 6.4.22) allows remote attac
CVE-2023-5803 MEDIUM
4.3 Nov 30

Cross-Site Request Forgery (CSRF) vulnerability in Business Directory Team Business Directory Plugin - Easy Listing Dire

Same weakness CWE-639 – Authorization Bypass Through User-Controlled Key

View all
CVE-2024-50483 CRITICAL
9.8
CVE-2026-55255 HIGH POC
8.4
CVE-2025-3605 CRITICAL POC
9.8
CVE-2022-3805 HIGH POC
8.6
CVE-2025-5947 CRITICAL POC
9.8
CVE-2020-36923 CRITICAL POC
9.8
CVE-2025-14998 CRITICAL POC
9.8
CVE-2023-3048 CRITICAL POC
9.8

Same technique Authentication Bypass

View all
CVE-2023-22515 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2013-2465 CRITICAL POC
9.8
CVE-2011-3544 CRITICAL POC
9.8
CVE-2022-40684 CRITICAL POC
9.8
CVE-2025-61882 CRITICAL POC
9.8
CVE-2024-0012 CRITICAL POC
9.3
CVE-2023-46805 HIGH POC
8.2

Share

CVE-2026-84769 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy