CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L
What the vulnerability does
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in CMSJunkie - WordPress Business Directory Plugins WP-BusinessDirectory wp-businessdirectory allows Blind SQL Injection.This issue affects WP-BusinessDirectory: from n/a through <= 3.1.4.
Explanation of Vulnerability in Simple Terms
WP-BusinessDirectory versions 3.1.4 and earlier contain a SQL injection vulnerability in database query handling. An unauthenticated attacker can craft malicious input to extract sensitive data from the WordPress database, including user credentials and business directory information. The vulnerability requires no user interaction and can be exploited remotely over the network.
What an attacker can do
Extract sensitive data from the WordPress database, including user information and business directory records.
Potential impact on your site
Attackers can read private user data, business listings, and potentially compromise user accounts if password hashes are exposed.
Conditions required to exploit
Network access to the WordPress site; no authentication or user interaction required.
Key dates
External resources
