Business Directory Plugin Insecure Direct Object Reference Vulnerability Allowing Arbitrary Image Addition

A vulnerability allowing Insecure Direct Object Reference (IDOR) has been identified in the Business Directory Plugin – Easy Listing Directories for WordPress, affecting all versions through 6.4.14. The issue arises in the 'ajax_listing_submit_image_upload' function, where inadequate validation of a user-controlled key enables unauthenticated attackers to upload arbitrary images to listings.

Impact

Exploitation of this vulnerability allows for unauthorized image uploads to WordPress listings, which could be misused to inject malicious content or disrupt the site's visual presentation.

Remediation

Users are advised to update the Business Directory Plugin to version 6.4.15 or later.