The Business Directory Plugin for WordPress suffers from an authorization bypass vulnerability (CWE-862) due to missing authorization checks in the wpbdp_ajax AJAX action. This allows unauthenticated attackers to modify arbitrary listings by directly referencing listing IDs in crafted requests. The vulnerability affects all versions up to and including 6.4.20. The CVSS 3.1 base score is 5.3 (medium severity) with network attack vector, low attack complexity, no privileges required, no user interaction, unchanged scope, no confidentiality or availability impact, but with integrity impact limited to modification of listing data.

An attacker without authentication can modify listing data such as titles, content, and email addresses in the affected plugin. This could lead to misinformation or unauthorized changes in the directory listings. There is no impact on confidentiality or availability according to the CVSS vector. No known exploits are currently reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the affected AJAX endpoint if possible or monitor for suspicious requests targeting listing modifications. Avoid exposing the plugin to untrusted users. Follow vendor updates closely for an official patch or mitigation.