Business Directory Plugin EUVD-2026-70577

No special conditions - remote unauthenticated exploitation against default configurations of Business Directory Plugin on any WordPress site running version 6.4.26 or earlier. The attacker needs only network access to the WordPress installation and knowledge of (or willingness to enumerate) valid object IDs. Exploitation is limited to the scope of business directory data; it does not yield code execution or WordPress admin access. Sites that restrict wp-admin or use a firewall to block access to specific plugin endpoints would reduce but not eliminate exposure, since the IDOR likely exists in front-facing listing endpoints.

CVSS 6.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N) accurately reflects a moderate risk: fully unauthenticated, no complexity or interaction required, but impact is bounded (low confidentiality, low integrity, no availability). EPSS data is not provided, and the vulnerability is not in CISA KEV, suggesting no confirmed active exploitation at time of analysis. The low impact scores reflect that exposed data is limited to business directory entries rather than credentials or system files, and write access alters listing content rather than achieves code execution. The primary real-world risk is mass enumeration and defacement of directory listings across installations - feasible due to predictable integer object IDs common in WordPress plugins. Sites where directory listings contain contact details or private business information face a meaningful confidentiality concern. No POC is referenced in the Patchstack report beyond the researcher disclosure, so risk remains theoretical but credible given the trivial exploitation conditions.

An unauthenticated attacker scans a target WordPress site and discovers it runs the Business Directory Plugin. By submitting HTTP requests that increment a numeric object ID parameter in the plugin's listing or record endpoint, the attacker retrieves or overwrites directory entries owned by other registered businesses. No credentials, session tokens, or user interaction are required - the attack is fully scriptable against any exposed installation.