CVE-2021-24249: 
WordPress vulnerability analysis and mitigation

The Business Directory Plugin for WordPress (versions before 5.11.2) was identified with a Cross-Site Request Forgery vulnerability, tracked as CVE-2021-24249. The vulnerability was discovered and publicly disclosed on April 12, 2021, by security researcher 0xB9 (WPScan).

The vulnerability is classified as a Cross-Site Request Forgery (CSRF) issue, corresponding to CWE-352. It received a CVSS score of 7.4 (High), indicating significant severity. The vulnerability falls under the OWASP Top 10 category A2: Broken Authentication and Session Management (WPScan).

The vulnerability allows attackers to force logged-in administrators to export files containing sensitive information. The exported data could include personally identifiable information (PII) such as email addresses and home addresses, which could then be accessed by the attacker (WPScan, CVE Mitre).

The exploit requires the target to be a logged-in administrator and involves base64 encoded state parameters. The workingdir field can be set to any existing location on the target system (WPScan).

The vulnerability was patched in version 5.11.2 of the Business Directory Plugin. Users are advised to update to this version or later to mitigate the security risk (WPScan).