CVE-2026-1656

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-1656", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2026-01-29T19:21:47.804Z", "datePublished": "2026-02-18T08:26:05.398Z", "dateUpdated": "2026-04-08T17:34:00.003Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:34:00.003Z"}, "affected": [{"vendor": "strategy11team", "product": "Business Directory Plugin \u2013 Easy Listing Directories for WordPress", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "6.4.20", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Business Directory Plugin for WordPress is vulnerable to authorization bypass due to a missing authorization check in all versions up to, and including, 6.4.20. This makes it possible for unauthenticated attackers to modify arbitrary listings, including changing titles, content, and email addresses, by directly referencing the listing ID in crafted requests to the wpbdp_ajax AJAX action."}], "title": "Business Directory Plugin <= 6.4.20 - Missing Authorization to Unauthenticated Arbitrary Listing Modification", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/f894ce75-168c-4baa-8cae-d2e7f1a0a9ab?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/business-directory-plugin/tags/6.4.20/includes/helpers/class-authenticated-listing-view.php#L20"}, {"url": "https://plugins.trac.wordpress.org/browser/business-directory-plugin/trunk/includes/helpers/class-authenticated-listing-view.php#L20"}, {"url": "https://plugins.trac.wordpress.org/changeset/3452627/business-directory-plugin/tags/6.4.21/includes/controllers/pages/class-submit-listing.php"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-862 Missing Authorization", "cweId": "CWE-862", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "baseScore": 5.3, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Sein Linn"}], "timeline": [{"time": "2026-02-17T20:07:01.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-02-18T12:26:23.236314Z", "id": "CVE-2026-1656", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-18T12:51:17.963Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-1656", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-02-18T12:26:23.236314Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-18T12:26:24.473Z"}}], "cna": {"title": "Business Directory Plugin <= 6.4.20 - Missing Authorization to Unauthenticated Arbitrary Listing Modification", "credits": [{"lang": "en", "type": "finder", "value": "Sein Linn"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 5.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"}}], "affected": [{"vendor": "strategy11team", "product": "Business Directory Plugin \u2013 Easy Listing Directories for WordPress", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "6.4.20"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2026-02-17T20:07:01.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/f894ce75-168c-4baa-8cae-d2e7f1a0a9ab?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/business-directory-plugin/tags/6.4.20/includes/helpers/class-authenticated-listing-view.php#L20"}, {"url": "https://plugins.trac.wordpress.org/browser/business-directory-plugin/trunk/includes/helpers/class-authenticated-listing-view.php#L20"}, {"url": "https://plugins.trac.wordpress.org/changeset/3452627/business-directory-plugin/tags/6.4.21/includes/controllers/pages/class-submit-listing.php"}], "descriptions": [{"lang": "en", "value": "The Business Directory Plugin for WordPress is vulnerable to authorization bypass due to a missing authorization check in all versions up to, and including, 6.4.20. This makes it possible for unauthenticated attackers to modify arbitrary listings, including changing titles, content, and email addresses, by directly referencing the listing ID in crafted requests to the wpbdp_ajax AJAX action."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-862", "description": "CWE-862 Missing Authorization"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:34:00.003Z"}}}, "cveMetadata": {"cveId": "CVE-2026-1656", "state": "PUBLISHED", "dateUpdated": "2026-04-08T17:34:00.003Z", "dateReserved": "2026-01-29T19:21:47.804Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2026-02-18T08:26:05.398Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Business Directory Plugin \u2013 Easy Listing Directories for WordPress", "vendor": "strategy11team", "versions": [{"lessThanOrEqual": "6.4.20", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Business Directory Plugin for WordPress is vulnerable to authorization bypass due to a missing authorization check in all versions up to, and including, 6.4.20. This makes it possible for unauthenticated attackers to modify arbitrary listings, including changing titles, content, and email addresses, by directly referencing the listing ID in crafted requests to the wpbdp_ajax AJAX action."}, {"lang": "es", "value": "El plugin Business Directory para WordPress es vulnerable a una omisi\u00f3n de autorizaci\u00f3n debido a la falta de una verificaci\u00f3n de autorizaci\u00f3n en todas las versiones hasta la 6.4.20, inclusive. Esto permite a atacantes no autenticados modificar listados arbitrarios, incluyendo el cambio de t\u00edtulos, contenido y direcciones de correo electr\u00f3nico, al referenciar directamente el ID del listado en solicitudes manipuladas a la acci\u00f3n AJAX wpbdp_ajax."}], "id": "CVE-2026-1656", "lastModified": "2026-06-17T10:16:15.807", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 1.4, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-1656", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-02-18T12:26:23.236314Z", "version": "2.0.3"}}]}, "published": "2026-02-18T09:15:58.403", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/business-directory-plugin/tags/6.4.20/includes/helpers/class-authenticated-listing-view.php#L20"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/business-directory-plugin/trunk/includes/helpers/class-authenticated-listing-view.php#L20"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/changeset/3452627/business-directory-plugin/tags/6.4.21/includes/controllers/pages/class-submit-listing.php"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/f894ce75-168c-4baa-8cae-d2e7f1a0a9ab?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-862"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,6.4.20]"}}], "enrichment": {"confidence": 88.0, "confidence_source": "matching", "scores": [{"score": 88.0, "source": "matching"}]}, "original": {"product": "Business Directory Plugin \u2013 Easy Listing Directories for WordPress", "source": "cna", "vendor": "strategy11team"}, "product": "business_directory_plugin_-_easy_listing_directories", "vendor": "strategy11"}, {"configurations": [{"platform": null, "status": "unaffected", "versions": null}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "product": "wordpress", "vendor": "wordpress"}], "analysis": {"en": {"generated_at": "2026-04-15T17:05:12.108711+00:00", "value": {"mitigation_remediation": ["Upgrade the Business Directory Plugin to version\u202f6.4.21 or later, which restores proper authorization checks for listing modifications.", "If an immediate upgrade is not possible, restrict unauthenticated POST requests to the wpbdp_ajax endpoint by configuring your web application firewall or .htaccess rules to block or challenge such traffic.", "Continuously monitor WordPress logs for unexpected wpbdp_ajax activity and verify that no listing changes are being made by unknown users."], "summary": {"action": "Patch", "impact": "Unauthenticated Arbitrary Listing Modification"}, "threat_synthesis": {"affected_systems": "The vulnerability affects all installations of the \"Business Directory Plugin \u2013 Easy Listing Directories for WordPress\" version 6.4.20 and earlier. Any WordPress site running these plugin versions is susceptible until the plugin is upgraded.", "description_and_impact": "The Business Directory Plugin for WordPress is vulnerable to an authorization bypass that allows attackers without authentication to alter any listing. By sending crafted requests to the wpbdp_ajax AJAX endpoint with a specific listing ID, an attacker can change title, content, and email fields. The result is loss of data integrity, potential defacement, phishing, or impersonation of businesses listed on the site.", "risk_and_exploitability": "The CVSS score of 5.3 indicates moderate severity, and the EPSS score of less than 1\u202f% suggests a very low probability of exploitation in the wild. The weakness is a missing authorization check (CWE\u2011862), exposing an unauthenticated HTTP access path that can be leveraged simply by referencing the listing ID in an AJAX request. Because the control is purely in the application and not in the WordPress core, the risk is confined to the affected plugin, though the impact on site content can be significant."}}}}, "created": "2026-02-19T10:20:30.858042+00:00", "updated": "2026-04-15T17:30:10.433004+00:00", "vendors": ["strategy11", "strategy11$PRODUCT$business_directory_plugin_-_easy_listing_directories", "wordpress", "wordpress$PRODUCT$wordpress"]}