CVE-2025-64630: 
WordPress vulnerability analysis and mitigation

CVE-2025-64630 is a Missing Authorization (Broken Access Control) vulnerability in the Business Directory Plugin for WordPress, developed by Strategy11 Team. It affects all versions of the plugin up to and including 6.4.19, allowing authenticated attackers with high privileges (Author/Developer level) to exploit incorrectly configured access control security levels. The vulnerability was reported on November 15, 2025, and publicly disclosed on December 15–16, 2025. It carries a CVSS v3.1 base score of 4.9 (Medium), as assessed by Patchstack (Patchstack).

The vulnerability is classified as CWE-862 (Missing Authorization), meaning the plugin fails to properly verify whether an authenticated user has the appropriate permissions before executing certain privileged actions. This maps to OWASP Top 10 category A1: Broken Access Control. Exploitation requires network access and a high-privilege authenticated account (Author or Developer role), but no user interaction is needed. No public proof-of-concept code has been identified at this time (Patchstack).

Successful exploitation could allow an authenticated attacker with Author or Developer-level privileges to perform actions beyond their intended access level within the Business Directory plugin, potentially affecting the availability of the plugin's functionality. The CVSS v3.1 vector (as updated by Patchstack in April 2026) indicates no confidentiality or integrity impact, but a low availability impact. The overall risk is assessed as low, with Patchstack noting the vulnerability is unlikely to be exploited in a targeted manner, though such flaws can be leveraged in mass-exploit campaigns against WordPress sites (Patchstack).

No active in-the-wild exploitation has been reported for CVE-2025-64630. The EPSS score is approximately 0.017% (0.000170), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Patchstack classifies this as low priority with no impactful threat identified (Patchstack).

The vendor has released version 6.4.20 of the Business Directory Plugin, which patches this vulnerability. Site administrators should update the plugin to version 6.4.20 or later immediately. Patchstack users can enable auto-update for vulnerable plugins as an additional safeguard. If an immediate update is not possible, site owners should consult their hosting provider or web developer for assistance (Patchstack).