CVE-2026-94173: WordPress Business Directory plugin <= 6.4.27 - Insecure Direct Object References (IDOR) vulnerability
Published Sep 30, 2026
·Updated
Contributor Insecure Direct Object References (IDOR) in Business Directory <= 6.4.27 versions.
Affected Software
1 affected component
WordPress Business Directory plugin<=6.4.27
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WordPress Business Directory pluginto a version that resolves this vulnerability.Fixed in 6.4.28
Event History
Sep 30, 2026
CVE Published
via MITRE·12:27 PM
Data Sourced
via MITRE·12:27 PM
RemedyDescriptionSeverityWeakness
Data Sourced
via NVD·01:17 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Who can exploit this issue?
An attacker needs Contributor-level access to a WordPress site using the Business Directory plugin in an affected version. No user interaction is required.
2
What impact can successful exploitation have?
The vulnerability can affect integrity and availability, while confidentiality impact is rated as none. The supplied severity vector indicates low integrity and low availability impact.