Business Directory Plugin – Easy Listing Directories for WordPress Security & Risk Analysis

The Business Directory Plugin v6.4.22 presents a moderate security risk. While it demonstrates a good effort in securing its SQL queries and output with high percentages of prepared statements and proper escaping, significant concerns arise from its attack surface and historical vulnerability patterns. The plugin has a substantial number of AJAX handlers, with 13 identified as lacking authentication checks. This, combined with one high-severity taint flow with unsanitized paths, indicates a potential for unauthorized access or data manipulation. The plugin's history of 16 CVEs, including one critical and six high-severity vulnerabilities, highlights a recurring pattern of authorization and input sanitization weaknesses. Although there are currently no unpatched CVEs, the historical prevalence of these types of flaws suggests a need for continued vigilance and prompt patching of any future vulnerabilities. The presence of the `unserialize` function also warrants caution, as it can be a vector for remote code execution if not handled with extreme care and proper input validation. The plugin's last recorded vulnerability date is in the future, which could indicate an error in the data or the need for further investigation into recent security assessments. Overall, the plugin has strengths in its SQL and output handling but suffers from significant weaknesses in its attack surface and a concerning history of security flaws.