The vulnerability is an Insecure Direct Object Reference that allows a user to alter a request parameter and retrieve or manipulate objects that should be restricted. An attacker could potentially read or modify entries in the Business Directory, exposing sensitive information or altering listings. The weakness is categorized as CWE‑639, indicating improper authorization controls that could compromise confidentiality and integrity of directory data.

This flaw affects WordPress sites running the Business Directory plugin from the Strategy11 Team, versions up to and including 6.4.27. Site administrators should verify the plugin version and update it to at least 6.4.28.

The CVSS score of 5.4 indicates a moderate impact, and the EPSS score is not available, so no data is available on exploit prevalence. The vulnerability is not listed in CISA’s KEV catalog, implying no known widespread exploitation at the time. The most likely attack vector is a manual manipulation of URLs or form fields that reference Business Directory objects, which an authenticated user with sufficient privileges could exploit if authorization checks are missing.