CVE-2026-57339: Business Directory Auth Bypass Flaw

CVE-2026-57339 Overview

CVE-2026-57339 is a broken access control vulnerability in the Business Directory WordPress plugin affecting all versions up to and including 6.4.23. The flaw allows unauthenticated network attackers to reach functionality that should require authentication or authorization checks. The weakness is categorized as [CWE-862] Missing Authorization. Exploitation requires no user interaction and no privileges, and can be performed remotely against any WordPress site running the affected plugin.

Critical Impact
Unauthenticated attackers can invoke restricted plugin actions over the network, resulting in limited impact to data integrity and availability of directory listings managed by the plugin.

Affected Products

Business Directory Plugin for WordPress, versions <= 6.4.23
WordPress sites with the Business Directory Plugin installed and active
Any hosting environment exposing vulnerable plugin endpoints to the public internet

Discovery Timeline

2026-06-29 - CVE-2026-57339 published to the National Vulnerability Database
2026-06-29 - Last updated in NVD database

Technical Details for CVE-2026-57339

Vulnerability Analysis

The Business Directory Plugin exposes one or more plugin actions without validating whether the requesting user holds the required capability. This constitutes a Missing Authorization weakness under [CWE-862]. Because the plugin does not enforce a capability or nonce check on the affected code paths, requests arriving from unauthenticated sessions are processed as if they were authorized.

The attack surface is reachable over HTTP or HTTPS, typically via WordPress admin-ajax endpoints or REST routes registered by the plugin. Successful exploitation grants an attacker the ability to trigger plugin operations reserved for privileged users. The impact is limited to partial integrity and availability effects on plugin-managed data, such as directory entries, categories, or configuration values handled by the vulnerable action.

EPSS data places the exploitation probability at 0.196% with a percentile ranking that indicates lower observed interest relative to other CVEs at time of publication. No public exploit code, CISA KEV listing, or in-the-wild exploitation has been reported for this issue.

Root Cause

The root cause is the absence of proper authorization checks in one or more plugin handlers. WordPress plugins are expected to call current_user_can() and verify a nonce with check_ajax_referer() or wp_verify_nonce() before executing privileged operations. In the vulnerable code paths, these validations are missing or insufficient, allowing anonymous callers to reach protected functionality.

Attack Vector

An attacker crafts HTTP requests targeting the vulnerable plugin endpoint on a site running Business Directory <= 6.4.23. The request requires no authentication cookies, no session, and no user interaction. Because the vulnerability is network-accessible and the plugin action lacks authorization enforcement, the server executes the request and returns a response reflecting the intended privileged behavior. See the Patchstack Vulnerability Report for technical details on the specific handler and payload.

Detection Methods for CVE-2026-57339

Indicators of Compromise

Unauthenticated POST or GET requests to wp-admin/admin-ajax.php referencing Business Directory plugin actions from unfamiliar source IP addresses.
Unexpected modifications, additions, or deletions in Business Directory listings, categories, or plugin configuration without a corresponding logged-in administrator session.
Web server access logs showing bursts of requests to plugin-specific REST routes registered under the Business Directory namespace.

Detection Strategies

Inventory all WordPress instances and identify those running the Business Directory Plugin at version 6.4.23 or earlier.
Deploy web application firewall rules that inspect request parameters for plugin action names and flag unauthenticated invocations.
Correlate WordPress audit logs with web server logs to identify plugin actions executed without a valid authenticated session.

Monitoring Recommendations

Enable a WordPress activity logging plugin to record plugin-level actions and administrative changes.
Monitor outbound network activity from the WordPress host for anomalies following suspicious inbound requests.
Alert on repeated 200 OK responses to unauthenticated requests targeting plugin endpoints under admin-ajax.php or REST routes.

How to Mitigate CVE-2026-57339

Immediate Actions Required

Update the Business Directory Plugin to a version later than 6.4.23 as soon as the vendor publishes a patched release.
Restrict administrative endpoints such as admin-ajax.php and plugin REST routes behind a web application firewall until patching is complete.
Audit existing directory listings and plugin settings for unauthorized changes and restore from backups where necessary.

Patch Information

Refer to the Patchstack Vulnerability Report for the fixed version and remediation guidance issued by the plugin maintainer. Apply the vendor-supplied update through the WordPress plugin manager or via WP-CLI.

Workarounds

Temporarily deactivate the Business Directory Plugin if a patched version is not yet available and the plugin is not business-critical.
Deploy WAF rules that block unauthenticated requests to the specific plugin actions identified in the Patchstack advisory.
Enforce IP allowlisting on wp-admin and admin-ajax.php where operationally feasible to limit exposure of plugin endpoints.

bash

# Update the plugin using WP-CLI once a patched release is available
wp plugin update business-directory-plugin

# Verify the installed version is greater than 6.4.23
wp plugin get business-directory-plugin --field=version