CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
What the vulnerability does
Cross-Site Request Forgery (CSRF) vulnerability in Business Directory Team Business Directory Plugin – Easy Listing Directories for WordPress allows Cross-Site Request Forgery.This issue affects Business Directory Plugin – Easy Listing Directories for WordPress: from n/a through 6.3.10.
Explanation of Vulnerability in Simple Terms
The Business Directory Plugin for WordPress versions up to 6.3.10 contains a cross-site request forgery (CSRF) vulnerability. An attacker can craft a malicious webpage that, when visited by a logged-in site administrator, performs unwanted actions within the plugin without the admin's knowledge or consent. The vulnerability requires the admin to visit the attacker's page while authenticated to the WordPress site.
What an attacker can do
Perform unwanted actions in the plugin on behalf of a logged-in administrator without their consent.
Potential impact on your site
An attacker could modify plugin settings or data if they trick an admin into visiting a malicious page while logged in.
Conditions required to exploit
A logged-in WordPress administrator must visit a page controlled by the attacker.
Key dates
External resources
Related vulnerabilities
