CVE-2026-86789 Information disclosure in Connections Business Directory
Unauthenticated attackers can access private or unlisted directory entries via REST API, exposing sensitive personal and business data.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-86789?
CVE-2026-86789 is a medium-severity vulnerability in Unknown Connections Business Directory, published on 30 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The Connections Business Directory WordPress plugin through 10.4.67 does not apply its visibility and moderation-status restrictions on certain REST API read endpoints, allowing unauthenticated attackers to retrieve directory entries that are marked private or unlisted, or that are still pending moderation, including entry names, organizations, biographies, internal notes and street addresses. The Connections Business Directory WordPress plugin through 10.4.67 has been closed on WordPress.org and no fixed version is available, so site owners should remove it or restrict unauthenticated access to its REST API routes.
Weakness: CWE-200
Which versions are affected by CVE-2026-86789?
How do I fix CVE-2026-86789?
No fix has been published for CVE-2026-86789 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-86789 being exploited?
There is no known exploitation of CVE-2026-86789 in the wild and no public exploit code.
Sources
Also known as GHSA-w7qq-wcpg-3wf8.