The vulnerability identified as CVE-2025-32629 affects the WP-BusinessDirectory plugin for WordPress developed by CMSJunkie. It is an improper limitation of a pathname to a restricted directory, commonly known as a Path Traversal vulnerability. This allows an unauthenticated attacker to manipulate file path inputs to access files and directories outside the intended scope. The affected versions include all releases up to 3.1.2. The CVSS v3.1 base score is 8.6, indicating high severity, with network attack vector, low attack complexity, no privileges required, no user interaction, and a scope change. The impact is limited to availability, causing denial of service, with no confidentiality or integrity impact. There is no information about known exploits in the wild or available patches.

The vulnerability can be exploited remotely without authentication or user interaction. It does not compromise confidentiality or integrity but can cause denial of service, impacting availability of the affected system. No known active exploitation has been reported. The scope of impact extends beyond the vulnerable component due to the scope change in CVSS.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are provided at this time. Users should monitor CMSJunkie and WP-BusinessDirectory plugin advisories for updates. Until a patch is available, consider restricting access to the plugin files and directories at the web server level to mitigate exploitation risk.