Signal is active with 2 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
The Business Directory Plugin for WordPress is vulnerable to authorization bypass due to a missing authorization check in all versions up to, and including, 6.4.20. This makes it possible for unauthenticated attackers to modify arbitrary listings, including changing titles, content, and email addresses, by directly referencing the listing ID in crafted requests to the wpbdp_ajax AJAX action.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
CVE-2026-1656 Authorization Bypass in WordPress Business Directory Plugin Allows Arbitrary Listing Modification https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-1656
Post summary
The entry announces CVE-2026-1656, an authorization bypass in the WordPress Business Directory Plugin that permits arbitrary listing modification.
CVE-2026-1656 The Business Directory Plugin for WordPress is vulnerable to authorization bypass due to a missing authorization check in all versions up to, and including, 6.4.20. Thi… https://www.cve.org/CVERecord?id=CVE-2026-1656
Post summary
The Business Directory Plugin for WordPress is vulnerable to an authorization bypass (CVE-2026-1656) in all versions up to 6.4.20 due to a missing authorization check.