CVE-2026-86789

Name of the Vulnerable Software and Affected Versions Connections Business Directory WordPress plugin versions prior to 10.4.68

Description Certain REST API read endpoints fail to apply visibility and moderation-status restrictions. This allows unauthenticated attackers to retrieve directory entries marked as private, unlisted, or pending moderation. Exposed data may include entry names, organizations, biographies, internal notes, and street addresses.

Recommendations Remove the plugin. Restrict unauthenticated access to the REST API routes.