CVE-2025-64219 Overview
CVE-2025-64219 is a Missing Authorization vulnerability [CWE-862] in the Strategy11 Team Business Directory plugin for WordPress. The flaw affects business-directory-plugin versions up to and including 6.4.18. An authenticated attacker with low privileges can exploit incorrectly configured access control checks to perform actions outside their permitted scope. The issue impacts integrity but does not affect confidentiality or availability, per the published CVSS vector.
Critical Impact
Authenticated users with low privileges can bypass access control checks in the Business Directory plugin and modify data they should not be able to reach.
Affected Products
- Strategy11 Team Business Directory plugin (business-directory-plugin)
- All versions from n/a through 6.4.18
- WordPress sites with the plugin installed and activated
Discovery Timeline
- 2025-10-29 - CVE-2025-64219 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-64219
Vulnerability Analysis
The vulnerability is a broken access control issue in the Business Directory WordPress plugin. The plugin exposes functionality that fails to correctly validate the authorization level of the requesting user. As a result, a user holding a low-privilege authenticated role can invoke operations that should be restricted to higher-privileged roles such as editors or administrators.
The issue is classified under CWE-862: Missing Authorization. This class of flaw occurs when an application performs an action without verifying that the caller has the required permissions. In WordPress plugins, this frequently maps to missing current_user_can() checks or missing capability validation inside AJAX action handlers and REST endpoints.
According to the Patchstack WordPress Vulnerability Report, the flaw is exploitable over the network by an authenticated user and results in a limited integrity impact.
Root Cause
The root cause is an incorrectly configured access control security level inside the plugin. One or more handlers in business-directory-plugin accept requests from authenticated users without enforcing the capability level required for the underlying action. The authorization check is either absent or evaluates a role that is too permissive.
Attack Vector
Exploitation requires the attacker to hold an authenticated session on the target WordPress site, such as a subscriber or contributor account. The attacker then issues a crafted HTTP request to the vulnerable plugin endpoint. Because the endpoint does not enforce the correct capability, the request succeeds and modifies plugin-managed data. No user interaction is required, and the attack complexity is low.
No public proof-of-concept exploit code has been published for CVE-2025-64219. See the Patchstack advisory linked above for further technical detail.
Detection Methods for CVE-2025-64219
Indicators of Compromise
- Unexpected creation, modification, or deletion of Business Directory listings by low-privileged accounts such as subscribers or contributors.
- WordPress audit log entries showing plugin AJAX or REST actions invoked by user roles that would not normally use them.
- HTTP POST requests to admin-ajax.php referencing Business Directory actions from newly registered or dormant user accounts.
Detection Strategies
- Enable a WordPress activity log plugin and alert on Business Directory actions performed by non-administrator accounts.
- Review web server access logs for repeated requests to plugin endpoints correlated with low-privilege session cookies.
- Compare current plugin data against known-good backups to identify unauthorized modifications.
Monitoring Recommendations
- Forward WordPress and web server logs to a centralized SIEM for correlation across authentication and application-layer events.
- Track newly created user accounts followed by immediate access to plugin AJAX or REST endpoints.
- Monitor the installed plugin version and alert when hosts continue to run business-directory-plugin6.4.18 or earlier.
How to Mitigate CVE-2025-64219
Immediate Actions Required
- Update the Business Directory plugin to a fixed release above 6.4.18 as soon as the vendor publishes a patched version.
- Audit existing WordPress user accounts and remove or disable dormant low-privilege accounts that are not required.
- Review the Business Directory data for unauthorized changes and restore from backup if tampering is confirmed.
Patch Information
Refer to the Patchstack advisory for the Business Directory plugin for patched version details. Administrators should apply the vendor-supplied update through the WordPress plugin manager once available and confirm the version reported in the admin dashboard is later than 6.4.18.
Workarounds
- Disable the Business Directory plugin until a patched release is installed if the directory functionality is not business-critical.
- Restrict new user self-registration on the WordPress site, or set the default role to a value that limits API access.
- Deploy a WordPress-aware web application firewall rule to block requests to Business Directory AJAX and REST endpoints originating from non-privileged sessions.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
