Unauthenticated Broken Access Control in Business Directory <= 6

CVE-2026-57339 is a missing authorization flaw (CWE-862) in the Business Directory Plugin – Easy Listing Directories for WordPress in all versions <= 6.4.23. The plugin exposes an AJAX entry point (the wpbdp_ajax family of actions, consistent with the prior CVE-2026-1656 pattern) that accepts a listing identifier but fails to verify that the caller owns the listing — or is even logged in. An unauthenticated remote attacker can craft a POST that flips listing titles, body content, contact emails, or category bindings on listings they do not own.

Patchstack/vendor-assigned MEDIUM (6.5, AV:N/AC:L/PR:N/UI:N/C:N/I:L/A:L) is *defensible but generous* for a real-world fleet. The score is driven entirely by unauth-network reach; impact is capped at integrity:LOW + availability:LOW with no confidentiality bleed and no path to RCE, SQLi, or auth-context escape. On a 10,000-host estate this is a content-tampering bug on a self-contained plugin, not a foothold-class issue. Downgrade is justified.

Why this verdict

• No confidentiality impact — CVSS vector explicitly says C:N. There is no database read, no PII egress, no credential disclosure. The bug only writes existing fields.
• Role multiplier — low-value role only. BDP runs on marketing/community/SMB sites as a *directory feature*. It is never deployed as an identity provider, hypervisor, CA, CI/CD node, backup admin, or kernel agent. No realistic deployment puts BDP on a high-value-role host, so the deployment-role floor does not apply.
• Population is narrow — ~10–20k WP installs run BDP versus ~810M WordPress sites globally (sub-0.003% of the WP fleet). On a 10,000-host enterprise estate, BDP typically appears on 0–3 marketing properties at most.
• Compensating controls already cover most exposure — Wordfence, Patchstack, Sucuri, and managed WP hosts (WP Engine, Kinsta) push virtual patches for plugin-AJAX authorization bypasses within hours of disclosure.
• No chain to RCE or auth-context escape — even with the write primitive, BDP fields are output-escaped, blocking stored-XSS uplift in the default templates.

Why not higher?

MEDIUM/HIGH would require either confidentiality impact (none here), an RCE/auth-bypass chain (none here), or a high-value-role deployment (BDP is never one). CVSS:N/AC:L/PR:N earns the network-reachable badge, but the I:L + A:L cap on a directory plugin caps real-world damage at SEO spam and listing defacement — that is LOW for an enterprise defender.

Why not lower?

IGNORE is wrong because the bug is unauthenticated, network-reachable, and trivially weaponizable — once a PoC lands the script-kiddie population will mass-scan for it, and brand-damage / phishing-pivot scenarios are real. It belongs on the patch backlog, not in the dustbin.

1. Inventory WordPress estate for the business-directory-plugin slug — Query your WP fleet management (ManageWP, MainWP, InfiniteWP) or grep wp-content/plugins/business-directory-plugin/ across managed hosts. You cannot prioritize what you cannot see. No mitigation SLA at LOW — but get the inventory done within the standard 30-day asset-management cadence.
2. Update BDP to the fixed release (>= 6.4.24) on the normal patch cycle — WP plugin upgrades are non-disruptive; chain it into your next monthly content-platform maintenance window. Under the noisgate remediation SLA for LOW, this is backlog hygiene — close within the standard 365-day window, but realistically WP plugins should ride the monthly cycle (~30 days).
3. Enable Wordfence / Patchstack / Sucuri managed WAF on internet-facing WP sites — These vendors push CVE-specific virtual patches within hours of disclosure and will block the wpbdp_ajax unauth-write pattern automatically. This is the cheapest insurance against the next BDP bug too.
4. Turn on BDP listing-moderation mode while you patch — In BDP settings, require admin approval for listing edits. Unauth writes still hit the table but queue for review rather than going live — neutralizes SEO/phishing impact.
5. Add a content-integrity check for the directory tables — A nightly diff of wp_posts rows with post_type = wpbdp_listing plus the wp_postmeta rows for _wpbdp_* keys catches silent tampering. Pipe diffs to Slack/SIEM.

Run on each WordPress host as the web user (or root) from the WP install root. Invoke as ./check-bdp.sh /var/www/html — pass the path to your WordPress installation. Requires read access to the plugin directory; no DB credentials needed.

#!/usr/bin/env bash
# noisgate verification: CVE-2026-57339 — Business Directory Plugin <= 6.4.23
# Usage: ./check-bdp.sh /path/to/wordpress
set -u

WP_ROOT="${1:-/var/www/html}"
PLUGIN_DIR="$WP_ROOT/wp-content/plugins/business-directory-plugin"
FIXED="6.4.24"

if [ ! -d "$WP_ROOT" ]; then
  echo "UNKNOWN: $WP_ROOT is not a directory"
  exit 2
fi

if [ ! -d "$PLUGIN_DIR" ]; then
  echo "PATCHED: business-directory-plugin not installed at $WP_ROOT"
  exit 0
fi

# Parse plugin header for Version: line
HEADER_FILE="$PLUGIN_DIR/business-directory-plugin.php"
if [ ! -f "$HEADER_FILE" ]; then
  # Some forks rename the entry file; fall back to readme
  HEADER_FILE="$PLUGIN_DIR/readme.txt"
fi

VERSION=$(grep -m1 -iE '^[[:space:]]*(Stable tag|Version):' "$HEADER_FILE" 2>/dev/null \
  | sed -E 's/.*[: ]+([0-9]+\.[0-9]+(\.[0-9]+)?).*/\1/')

if [ -z "$VERSION" ]; then
  echo "UNKNOWN: could not parse plugin version from $HEADER_FILE"
  exit 2
fi

# version_compare: returns 0 if $1 < $2
vlt() {
  [ "$(printf '%s\n%s\n' "$1" "$2" | sort -V | head -n1)" = "$1" ] && [ "$1" != "$2" ]
}

if vlt "$VERSION" "$FIXED"; then
  echo "VULNERABLE: business-directory-plugin $VERSION (<= 6.4.23, fix is $FIXED) at $PLUGIN_DIR"
  exit 1
else
  echo "PATCHED: business-directory-plugin $VERSION (>= $FIXED) at $PLUGIN_DIR"
  exit 0
fi

Sources

1. Patchstack — Business Directory Plugin vulnerability database
2. Patchstack — Broken Access Control in Business Directory Plugin (prior CVE pattern)
3. Managed-WP — CVE-2026-1656 advisory (same plugin, prior version range)
4. FreshySites — CVE-2026-1656 bulletin
5. Wordfence Threat Intel — Business Directory Plugin
6. WPScan — Business Directory Plugin advisories
7. NVD — CVE-2026-57339 record (when published)
8. CISA KEV catalog (verify not listed)