The Business Directory plugin for WordPress contains a CSRF flaw that permits malicious sites to trigger actions on behalf of an authenticated user. Because the plugin does not adequately verify request origins or include anti‑CSRF tokens, an attacker can submit forged requests that modify or delete directory entries, potentially exposing or tampering with business listings.

Strategy11 Team Business Directory plugin, versions from the earliest release through and including 6.4.19, are affected. All earlier releases are also vulnerable.

The CVSS score of 4.3 indicates moderate severity, while the EPSS score of < 1% points to a low likelihood of exploitation at present. The vulnerability is not listed in the CISA KEV catalog. A likely attack vector involves a victim who is logged into WordPress and visits a malicious site that submits a forged request; no elevated privileges are required beyond those of a normal authenticated user.