This vulnerability in the Business Directory plugin by Strategy11 Team arises from missing authorization checks, which means that certain actions can be performed without proper access control validation. Affected versions include all up to 6.4.18. The issue is classified as a medium severity vulnerability with a CVSS 3.1 base score of 4.3, reflecting low complexity and low privileges required for exploitation, but only limited impact on integrity and no impact on confidentiality or availability. No patch or vendor advisory is currently provided, and the product is not a cloud service.

The vulnerability allows an attacker with low privileges to perform unauthorized actions that can modify data within the Business Directory plugin. There is no impact on confidentiality or availability reported. No known active exploitation has been observed.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, review and tighten access control configurations in the Business Directory plugin to prevent unauthorized modifications. Monitor for vendor updates regarding patches or official mitigations.