CVE-2026-1656: 
WordPress vulnerability analysis and mitigation

CVE-2026-1656 is a missing authorization vulnerability in the Business Directory Plugin for WordPress that allows unauthenticated attackers to modify arbitrary directory listings. The flaw affects all versions up to and including 6.4.20, enabling unauthorized changes to listing titles, content, and email addresses by referencing a listing ID in crafted requests to the wpbdp_ajax AJAX action. It was published on February 18, 2026, with a CVSS v3.1 base score of 5.3 (Medium) (Red Hat CVE).

The root cause is a missing authorization check (CWE-862) in the wpbdp_ajax AJAX action handler, which fails to verify whether the requesting user has permission to modify a given listing. Because no authentication or capability check is enforced, any unauthenticated network attacker can send a crafted HTTP POST request directly referencing an arbitrary listing ID to alter its data. The attack requires no privileges, no user interaction, and has low complexity, making it trivially exploitable against any exposed WordPress site running the vulnerable plugin (Red Hat CVE).

Successful exploitation allows unauthenticated attackers to modify the content of any business directory listing, including titles, descriptions, and contact email addresses, compromising the integrity of the directory data. While confidentiality and availability are not directly impacted, the ability to alter email addresses in listings could facilitate phishing or business email compromise against users who rely on the directory for contact information. The scope is limited to the affected WordPress plugin's data, with no direct path to full system compromise from this vulnerability alone (Red Hat CVE).

No public proof-of-concept exploit code or active in-the-wild exploitation has been reported for CVE-2026-1656 as of the available data. The EPSS score is approximately 0.059%, indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. However, the low attack complexity and lack of authentication requirements make it accessible to unsophisticated attackers if targeted (Red Hat CVE).

1. Reconnaissance: Identify WordPress sites running the Business Directory Plugin version 6.4.20 or earlier using tools like WPScan, Shodan, or by inspecting plugin metadata in publicly accessible WordPress installations.
2. Enumerate listing IDs: Browse the target site's business directory to collect valid listing IDs, which are typically exposed in page URLs or HTML source (e.g., ?page=wpbdp-listing&id=123).
3. Craft malicious AJAX request: Construct an HTTP POST request targeting the WordPress AJAX endpoint (/wp-admin/admin-ajax.php) with the action parameter set to wpbdp_ajax and include the target listing ID along with modified field values (e.g., title, content, email).
4. Submit unauthenticated request: Send the crafted request without any authentication cookies or nonces, exploiting the missing authorization check to overwrite the listing's data on the server.
5. Verify modification: Confirm the listing has been altered by visiting the affected listing page on the target site (Red Hat CVE).

• Network: Unusual unauthenticated HTTP POST requests to /wp-admin/admin-ajax.php with action=wpbdp_ajax and listing modification parameters from unexpected or anonymous IP addresses.
• Logs: WordPress access logs showing repeated POST requests to the AJAX endpoint without associated authenticated session cookies; entries modifying listing fields from IPs with no prior site interaction.
• Application: Unexpected changes to business directory listing titles, descriptions, or contact email addresses without corresponding authenticated user activity in WordPress admin audit logs.

Users should update the Business Directory Plugin to a version beyond 6.4.20 that includes a proper authorization check on the wpbdp_ajax AJAX action. Until a patch is applied, site administrators can consider disabling the plugin or restricting access to the WordPress AJAX endpoint via web server rules for unauthenticated users as a temporary workaround. Monitoring WordPress audit logs for unexpected listing modifications is also recommended (Red Hat CVE).

Coverage of CVE-2026-1656 has been limited to vulnerability aggregation platforms and security databases, with no notable vendor statements or significant researcher commentary identified beyond the initial disclosure. A brief write-up was published by Infinitsec shortly after disclosure (Red Hat CVE).