The Connections Business Directory WordPress plugin, through version 10.4.67, fails to enforce visibility and moderation restrictions on specific REST API read endpoints. As a result, an attacker who does not have authentication can fetch directory entries that are marked private, unlisted, or pending moderation. Disclosed data includes entry names, organizations, biographies, internal notes, and street addresses, thereby compromising confidentiality of user information.

The vulnerability applies to the Connections Business Directory WordPress plugin for all installations running version 10.4.67 or earlier. The plugin has been closed on WordPress.org and no fixed release is available, so affected sites must either uninstall the plugin or otherwise restrict access to its REST API routes.

Because the REST API routes can be accessed without authentication, the attack vector is straightforward: an attacker only needs to send a request to the exposed cn-api/v1 endpoints. The CVSS score of 5.3 indicates moderate severity, while the EPSS score of < 1% suggests a low likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog, but the sensitive nature of the disclosed information means the potential impact remains significant. The risk remains high for any site that has the plugin installed and exposes its REST API to unauthenticated users.