CVE-2025-67596: CSRF in Business Directory WordPress Plugin

The CSRF vulnerability in Business Directory allows an attacker to execute actions on behalf of an authenticated user without their knowledge or consent. This could involve creating, modifying, or deleting business listings, changing user roles, or performing other administrative tasks. The impact is directly proportional to the privileges of the user being impersonated. A malicious actor could leverage this to gain control over the plugin's functionality and potentially compromise the entire WordPress site if the plugin has elevated privileges or access to sensitive data. The blast radius extends to any user with access to the Business Directory plugin, particularly administrators.

1. Reserved2025-12-09
2. Published2025-12-09
3. Modified2026-04-28
4. EPSS updated2026-03-23

The primary mitigation for CVE-2025-67596 is to immediately upgrade the Business Directory WordPress plugin to version 6.4.20 or later. If upgrading is not immediately feasible due to compatibility issues or breaking changes, consider implementing a Web Application Firewall (WAF) with CSRF protection rules. These rules can validate that requests originate from the expected source. Additionally, ensure that all user input is properly validated and sanitized to prevent malicious code injection. After upgrading, confirm the fix by attempting to trigger a CSRF attack using a tool like Burp Suite and verifying that the request is blocked or fails.

Active installs

10KKnown

Plugin rating