CVE-2026-2576

HIGH 7.5

Business Directory Plugin <= 6.4.21 - Unauthenticated SQL Injection via payment Parameter

CVSS Score

7.5

EPSS Score

0.1%

EPSS Percentile

26th

The Business Directory Plugin – Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based SQL Injection via the 'payment' parameter in all versions up to, and including, 6.4.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

CWE	CWE-89
Vendor	strategy11team
Product	business directory plugin – easy listing directories for wordpress
Published	Feb 18, 2026
Last Updated	Feb 18, 2026

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Attack Complexity

Privileges Required

User Interaction

Scope

Confidentiality

Integrity

Availability

Affected Versions

strategy11team / Business Directory Plugin – Easy Listing Directories for WordPress

* ≤ 6.4.21

References

NVD ↗ CVE.org ↗ EPSS Data ↗

wordfence.com: https://www.wordfence.com/threat-intel/vulnerabilities/id/d8ec7d25-1574-416c-b5fd-3a71b1cc09d2?source=cve plugins.trac.wordpress.org: https://plugins.trac.wordpress.org/browser/business-directory-plugin/tags/6.4.21/includes/db/class-db-query-set.php#L37 plugins.trac.wordpress.org: https://plugins.trac.wordpress.org/browser/business-directory-plugin/tags/6.4.21/includes/controllers/pages/class-checkout.php#L126 plugins.trac.wordpress.org: https://plugins.trac.wordpress.org/changeset/3463307/business-directory-plugin/trunk/includes/db/class-db-query-set.php

Credits

Sein Linn