CVE-2026-86789: CWE-200 Information Exposure in Connections Business Directory
The Connections Business Directory WordPress plugin through 10.4.67 does not apply its visibility and moderation-status restrictions on certain REST API read endpoints, allowing unauthenticated attackers to retrieve directory entries that are marked private or unlisted, or that are still pending moderation, including entry names, organizations, biographies, internal notes and street addresses. The Connections Business Directory WordPress plugin through 10.4.67 has been closed on WordPress.org and no fixed version is available, so site owners should remove it or restrict unauthenticated access to its REST API routes.
AI Analysis
Technical Summary
CVE-2026-86789 is an information exposure vulnerability (CWE-200) in the Connections Business Directory WordPress plugin versions up to and including 10.4.67. The plugin does not enforce its visibility and moderation-status restrictions on some REST API read endpoints, enabling unauthenticated attackers to retrieve sensitive directory entries marked as private, unlisted, or pending moderation. The exposed information includes personal and organizational details such as names, biographies, internal notes, and street addresses. The plugin has been closed on WordPress.org without a fixed version available.
Potential Impact
Unauthenticated attackers can access sensitive directory information that should be restricted, potentially leading to privacy violations and unauthorized disclosure of personal and organizational data. The exposure includes private and unlisted entries as well as those pending moderation, increasing the risk of sensitive information leakage.
Mitigation Recommendations
No official fix is available as the plugin has been removed from WordPress.org. Site owners should remove the Connections Business Directory plugin or implement strict access controls to restrict unauthenticated access to its REST API endpoints to prevent information disclosure.
CVE-2026-86789: CWE-200 Information Exposure in Connections Business Directory
Description
The Connections Business Directory WordPress plugin through 10.4.67 does not apply its visibility and moderation-status restrictions on certain REST API read endpoints, allowing unauthenticated attackers to retrieve directory entries that are marked private or unlisted, or that are still pending moderation, including entry names, organizations, biographies, internal notes and street addresses. The Connections Business Directory WordPress plugin through 10.4.67 has been closed on WordPress.org and no fixed version is available, so site owners should remove it or restrict unauthenticated access to its REST API routes.
Affected software
Connections Business Directory
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-86789 is an information exposure vulnerability (CWE-200) in the Connections Business Directory WordPress plugin versions up to and including 10.4.67. The plugin does not enforce its visibility and moderation-status restrictions on some REST API read endpoints, enabling unauthenticated attackers to retrieve sensitive directory entries marked as private, unlisted, or pending moderation. The exposed information includes personal and organizational details such as names, biographies, internal notes, and street addresses. The plugin has been closed on WordPress.org without a fixed version available.
Potential Impact
Unauthenticated attackers can access sensitive directory information that should be restricted, potentially leading to privacy violations and unauthorized disclosure of personal and organizational data. The exposure includes private and unlisted entries as well as those pending moderation, increasing the risk of sensitive information leakage.
Mitigation Recommendations
No official fix is available as the plugin has been removed from WordPress.org. Site owners should remove the Connections Business Directory plugin or implement strict access controls to restrict unauthenticated access to its REST API endpoints to prevent information disclosure.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- WPScan
- Date Reserved
- 2026-09-08T11:51:54.325Z
- State
- PUBLISHED
Threat ID: 6abcab01236a9c741f0494b3
Added to database: 09/30/2026, 06:24:01 UTC
Last enriched: 09/30/2026, 06:39:23 UTC
Last updated: 09/30/2026, 07:39:37 UTC
Views: 4
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.