Overview
CVE-2025-24759 is a critical vulnerability that affects the WordPress Business Directory Plugins WP-BusinessDirectory. The vulnerability is due to the improper neutralization of special elements used in an SQL command, commonly known as ‘SQL Injection’. This vulnerability allows attackers to execute Blind SQL Injection attacks, which could potentially lead to system compromise or data leakage. Given the wide use of WordPress plugins, the vulnerability poses a significant risk to a large number of websites and businesses.
Vulnerability Summary
CVE ID: CVE-2025-24759
Severity: Critical (9.3 CVSS score)
Attack Vector: Network
Privileges Required: Low
User Interaction: None
Impact: System compromise and potential data leakage
Affected Products
Escape the Surveillance Era
Most apps won’t tell you the truth.
They’re part of the problem.
Phone numbers. Emails. Profiles. Logs.
It’s all fuel for surveillance.
Ameeba Chat gives you a way out.
- • No phone number
- • No email
- • No personal info
- • Anonymous aliases
- • End-to-end encrypted
Chat without a trace.
Product | Affected Versions
WP-BusinessDirectory | n/a through 3.1.3
How the Exploit Works
The exploit takes advantage of the improper neutralization of certain special elements in SQL commands within the WP-BusinessDirectory plugin. This allows an attacker to manipulate SQL queries, leading to Blind SQL Injection. Blind SQL Injection is a type of SQL Injection attack that asks the database true or false questions and determines the answer based on the application’s response. This vulnerability can be exploited remotely by an attacker with low privileges, without any need for user interaction.
Conceptual Example Code
The following conceptual code demonstrates how the vulnerability might be exploited:
GET /wp-businessdirectory/api/query?param=value' OR '1'='1 HTTP/1.1
Host: vulnerablewebsite.comIn this example, the attacker modifies the `param` value in the URL to include an SQL Injection payload (`’ OR ‘1’=’1`). This payload changes the nature of the SQL query, potentially allowing the attacker to retrieve sensitive data from the database or manipulate its content.
Recommended Mitigations
The most effective mitigation for this vulnerability is to apply the patch provided by the vendor. If the patch cannot be applied immediately, using a Web Application Firewall (WAF) or Intrusion Detection System (IDS) can provide temporary mitigation. These systems can be configured to detect and block SQL Injection attempts, reducing the risk of exploitation.