WordPress Connections Business Directory plugin <= 10.4.67 - Unauthenticated Non-Public Directory Entry Disclosure vulnerability

Unauthenticated Non-Public Directory Entry Disclosure vulnerability discovered by Usama Arshad in WordPress Plugin Connections Business Directory versions = 10.4.67...

CVE-2026-86789

The Connections Business Directory WordPress plugin, in versions up to and including 10.4.67 , fails to enforce visibility and moderation-status restrictions on specific REST API read endpoints (specifically cn-api/v1 routes). This flaw allows unauthenticated attackers to retrieve sensitive infor...

CVE-2026-86789 Connections Business Directory <= 10.4.67 - Unauthenticated Non-Public Directory Entry Disclosure via cn-api/v1 REST Routes

The Connections Business Directory WordPress plugin through 10.4.67 does not apply its visibility and moderation-status restrictions on certain REST API read endpoints, allowing unauthenticated attackers to retrieve directory entries that are marked private or unlisted, or that are still pending...