The Business Directory Plugin – Easy Listing Directories for WordPress contains an authorization bypass vulnerability (CWE-639) identified as CVE-2024-13887. The issue arises from insufficient validation of a user-controlled key parameter in the 'ajax_listing_submit_image_upload' function, enabling unauthenticated attackers to upload arbitrary images to listings. This insecure direct object reference affects all plugin versions up to and including 6.4.14. The CVSS 3.1 base score is 5.3 (medium severity), reflecting network attack vector, low complexity, no privileges required, no user interaction, and limited impact on integrity only.

An attacker can add arbitrary images to listings without authentication, potentially leading to unauthorized content injection. There is no direct impact on confidentiality or availability. The integrity of listing content can be compromised, which may affect the trustworthiness of listings displayed by the plugin.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should monitor for updates from the plugin vendor. Restricting access to the affected function or disabling image uploads via AJAX may reduce risk but could impact functionality. No vendor advisory or patch links are currently provided.