CVE-2026-62097: WordPress Business Directory plugin <= 6.4.27 - SQL Injection vulnerability
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WPTasty Business Directory business-directory-plugin allows Blind SQL Injection.This issue affects Business Directory: from n/a through 6.4.27.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WordPress Business Directory pluginto a version that resolves this vulnerability.Fixed in 6.4.28
Event History
Frequently Asked Questions
What access does an attacker need to exploit this issue?
The vulnerability has a high privileges required rating (PR:H), so exploitation requires an attacker to already hold high-level privileges in the affected WordPress environment. No user interaction is required.
Can this be exploited remotely?
Yes. The attack vector is network-based (AV:N) and the attack complexity is rated low (AC:L). However, the attacker must first have the required high privileges.
Which installations are affected?
WPTasty Business Directory versions through 6.4.27 are affected. The available data does not identify a fixed version or provide a configuration-based workaround.
What is the potential impact of successful exploitation?
Successful exploitation enables blind SQL injection and is rated as having high confidentiality impact. The supplied metrics indicate no integrity impact and low availability impact, while the scope may extend beyond the vulnerable component (S:C).