Business Directory EUVD-2026-40110

No special conditions - remote unauthenticated exploitation against default installations of the Business Directory WordPress plugin version 6.4.23 and below. The CVSS vector PR:N/AC:L/UI:N confirms no account credentials, no elevated privileges, no specific site configuration, and no victim interaction are required. Exploitation is bounded by the impact ceiling: an attacker cannot extract sensitive data via this vector (C:N), limiting utility to disruption or unauthorized manipulation of directory content. The plugin must be installed and active on a WordPress site reachable from the attacker's network; WordPress sites behind authenticated reverse proxies or with IP-restricted admin endpoints reduce exposure.

The CVSS 3.1 score of 6.6 with vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L presents a mixed picture. The attack surface is maximally favorable - network-reachable, low complexity, no credentials, no interaction - which alone would suggest high urgency. However, the impact ceiling is low: confidentiality is wholly unaffected (C:N), and both integrity and availability impacts are rated Limited (I:L/A:L), indicating partial or constrained damage rather than full system compromise. No EPSS score was provided in the input data, and no KEV entry exists, suggesting no confirmed active mass exploitation. No POC code has been identified. Real-world risk is moderate: the vulnerability is easy to exploit at scale but the attacker gains limited leverage per affected site. Organizations running this plugin should treat it as a routine patch priority rather than an emergency, unless the plugin manages sensitive listing data where even limited modification is material.

An attacker with no account on the target WordPress site sends a crafted HTTP POST or GET request directly to an unprotected endpoint exposed by the Business Directory plugin - such as an admin-ajax.php action or a REST route - that lacks authorization checks. The server processes the request as though it were authorized, allowing the attacker to create, modify, or delete directory listings, or trigger actions that degrade availability of the directory feature. The low attack complexity and absence of authentication requirements mean this could be automated to scan and exploit vulnerable plugin installations at scale.