CVE-2025-24759: SQL Injection in WP-BusinessDirectory

The SQL Injection vulnerability in WP-BusinessDirectory allows an attacker to craft malicious SQL queries that are executed against the plugin's database. Because it's a 'blind' SQL injection, the attacker doesn't receive direct output from the queries, but can infer information through timing attacks or other techniques. This can be used to extract usernames, passwords, customer data, and other sensitive information stored in the database. Successful exploitation could lead to complete compromise of the WordPress site and its associated data. The lack of direct output makes detection more challenging, but the potential impact remains severe.

1. Reserved2025-01-23
2. Published2025-07-16
3. Modified2026-04-28
4. EPSS updated2026-03-23

The primary mitigation for CVE-2025-24759 is to immediately upgrade the WP-BusinessDirectory plugin to version 3.1.5 or later. If upgrading is not immediately feasible due to compatibility issues or breaking changes, consider implementing a Web Application Firewall (WAF) rule to block suspicious SQL injection attempts targeting the vulnerable endpoints. Specifically, look for unusual characters and patterns in GET and POST requests to the plugin's functionality. Regularly review database access logs for any unusual activity. After upgrading, confirm the fix by attempting a SQL injection payload on the vulnerable endpoint and verifying that it is properly sanitized.

Active installs

40

Plugin rating