Connections Business Directory CVE-2026-86789

Requires only that the Connections Business Directory plugin (version ≤10.4.67) be installed and active with its REST API accessible, which is the default for WordPress REST routes. No authentication, no user interaction, and no non-default configuration are needed - the affected read endpoints simply omit visibility and moderation-status checks. The practical limiting factors are that only entries marked private, unlisted, or pending moderation are exposed (public entries offer no new information), impact is confined to confidentiality, and sites that have already removed the plugin or blocked its REST routes (the only available mitigations, since no patch exists) are not exploitable.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N, base 5.3) describes a network-reachable, low-complexity, unauthenticated information-disclosure flaw affecting confidentiality only - no integrity or availability impact. SSVC aligns with this: Exploitation is rated 'none' (no public exploit identified at time of analysis), Automatable is 'yes' (unauthenticated REST endpoints can be enumerated at scale), and Technical Impact is 'partial' (data read only, no takeover). No EPSS score, no CISA KEV listing, and no POC were provided, so there is no evidence of active exploitation. The signals are internally consistent - this is a real but moderate-priority data-exposure issue rather than a critical one. The most important aggravating factor is not the score but the remediation gap: the plugin has been closed on WordPress.org with no fixed version, so exposure persists until owners manually remove the plugin or block the REST routes. Data exposed (internal notes, street addresses, private/pending entries) may carry privacy/GDPR consequences beyond what the C:L rating conveys.

An unauthenticated attacker sends crafted GET requests to the plugin's REST API read endpoints (e.g. under /wp-json/) on a site running Connections Business Directory ≤10.4.67, which fail to enforce visibility and moderation-status checks. The response returns directory entries that should be private, unlisted, or pending moderation - including names, organizations, biographies, internal notes, and street addresses. No public exploit code was identified at time of analysis, but the flaw is trivially automatable across many sites.