The Business Directory Plugin for WordPress is vulnerable to an authorization bypass that allows attackers without authentication to alter any listing. By sending crafted requests to the wpbdp_ajax AJAX endpoint with a specific listing ID, an attacker can change title, content, and email fields. The result is loss of data integrity, potential defacement, phishing, or impersonation of businesses listed on the site.

The vulnerability affects all installations of the "Business Directory Plugin – Easy Listing Directories for WordPress" version 6.4.20 and earlier. Any WordPress site running these plugin versions is susceptible until the plugin is upgraded.

The CVSS score of 5.3 indicates moderate severity, and the EPSS score of less than 1 % suggests a very low probability of exploitation in the wild. The weakness is a missing authorization check (CWE‑862), exposing an unauthenticated HTTP access path that can be leveraged simply by referencing the listing ID in an AJAX request. Because the control is purely in the application and not in the WordPress core, the risk is confined to the affected plugin, though the impact on site content can be significant.