CVE-2026-1656: Business Directory Plugin <= 6.4.20 - Missing Authorization to Unauthenticated Arbitrary Listing Modification
The Business Directory Plugin for WordPress is vulnerable to authorization bypass due to a missing authorization check in all versions up to, and including, 6.4.20. This makes it possible for unauthenticated attackers to modify arbitrary listings, including changing titles, content, and email addresses, by directly referencing the listing ID in crafted requests to the wpbdpajax AJAX action.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-1656?
The severity of CVE-2026-1656 is considered high due to the potential for unauthorized listing modifications.
How do I fix CVE-2026-1656?
To fix CVE-2026-1656, update the Business Directory Plugin to version 6.4.21 or later, which includes the required authorization checks.
Who is affected by CVE-2026-1656?
All users of the Business Directory Plugin for WordPress up to and including version 6.4.20 are affected by CVE-2026-1656.
What is the impact of CVE-2026-1656?
The impact of CVE-2026-1656 allows unauthenticated users to modify arbitrary listings in the Business Directory Plugin.
What versions of the Business Directory Plugin are vulnerable to CVE-2026-1656?
Versions of the Business Directory Plugin up to and including 6.4.20 are vulnerable to CVE-2026-1656.