Business Directory EUVD-2026-89841

Exploitation requires an authenticated WordPress account at Contributor level or higher on a site running the Business Directory plugin version 6.4.27 or earlier (PR:L). No user interaction is needed (UI:N) and the attack is performed remotely over the network (AV:N) with low complexity (AC:L) by tampering with a direct object reference (an ID parameter) so the application returns or alters records belonging to another user. The primary limiting factor is the need for a valid low-privilege account, which excludes purely anonymous internet attackers; impact is bounded to low integrity and availability effects with no confidentiality loss (C:N/I:L/A:L).

This is a moderate-severity, low-real-risk issue based on the balance of signals. The CVSS 3.1 base score is 5.4 (Medium) with vector AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L, meaning network-reachable and low-complexity but requiring authenticated privileges (PR:L, mapped to WordPress Contributor role) and yielding only low integrity and availability impact with no confidentiality loss. No EPSS score, no CISA KEV listing, and no public proof-of-concept were provided, so exploitation status is 'no public exploit identified at time of analysis.' The requirement for a valid Contributor account substantially narrows the realistic attacker population versus a fully unauthenticated flaw, and the C:N/I:L/A:L impact profile indicates limited blast radius (an IDOR letting an authenticated user manipulate objects they should not, rather than mass data theft or takeover). No signals conflict here - all point to a genuine-but-low-priority vulnerability. Priority is driven mainly by the plugin's install base rather than by exploitation urgency; absent KEV/EPSS/POC this does not warrant emergency patching, but it should be remediated in normal maintenance cycles.

An attacker who has registered or obtained a WordPress Contributor account on a site running Business Directory <= 6.4.27 crafts requests referencing object identifiers (e.g., directory listing or record IDs) belonging to other users, and because access is keyed on the supplied ID rather than ownership, they view or modify records they do not own. No public proof-of-concept was provided, and the low-complexity network vector (AC:L/AV:N) means the manipulation is a simple parameter change once authenticated. Impact is limited to low integrity/availability effects (I:L/A:L), such as tampering with or disrupting other users' directory entries.