Skip to content
Sign in
5.3 Medium

CVE-2026-86789 The Connections Business Directory WordPress plugin through 10.4.67 does not apply its visibility and…

Description

The Connections Business Directory WordPress plugin through 10.4.67 does not apply its visibility and moderation-status restrictions on certain REST API read endpoints, allowing unauthenticated attackers to retrieve directory entries that are marked private or unlisted, or that are still pending moderation, including entry names, organizations, biographies, internal notes and street addresses. The Connections Business Directory WordPress plugin through 10.4.67 has been closed on WordPress.org and no fixed version is available, so site owners should remove it or restrict unauthenticated access to its REST API routes.

Affected products and versions

Product Affected versions Fixed in
Connections Business Directory 10.4 earliest → 10.4.67 No fix stated

Other CVEs of Connections Business Directory

The 3 CVEs of Connections Business Directory →
CVE-2021-24794 The Connections Business Directory WordPress plugin before 10.4.3 does not escape the Address settings when creating… Not rated CVE-2020-36503 The Connections Business Directory WordPress plugin before 9.7 does not validate or sanitise some connections' fields,… Not rated
Track this CVE