CVE-2026-2576 is a time-based SQL Injection vulnerability in the Business Directory Plugin – Easy Listing Directories for WordPress, affecting all versions up to 6.4.2. The issue arises from improper neutralization of special elements in the 'payment' parameter, allowing unauthenticated attackers to append malicious SQL queries to existing database queries. This vulnerability is classified under CWE-89 and can be exploited remotely without privileges or user interaction. The CVSS 3.1 base score is 7.5, reflecting high impact on confidentiality but no impact on integrity or availability.

Successful exploitation of this vulnerability can lead to unauthorized disclosure of sensitive information from the database. The attacker does not require authentication or user interaction to exploit the flaw. There is no indication of impact on data integrity or system availability. No known active exploits have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling or restricting access to the vulnerable plugin, especially the functionality involving the 'payment' parameter. Monitor vendor channels for updates and apply patches promptly once available.