The Business Directory Plugin – Easy Listing Directories for WordPress is vulnerable to unauthenticated SQL Injection via the 'payment' parameter. Inadequate escaping of user-supplied input allows an attacker to append arbitrary SQL statements to existing queries, which can be used to extract sensitive information from the database. This flaw is classified as CWE‑89 and is rated high severity with a CVSS score of 7.5.

The affected product is the WordPress Business Directory Plugin published by strategy11team. Versions up to 6.4.2 inclusive contain the vulnerability. Users running the plugin on any WordPress installation within that version range are impacted.

With a CVSS score of 7.5 the vulnerability is considered high risk, though its EPSS score is less than 1% indicating a low probability of exploitation. The flaw does not require authentication and can be triggered by a crafted HTTP request containing a malicious 'payment' value, allowing attackers to read, and potentially modify, database data. The vulnerability is not listed in the CISA KEV catalog.