What’s Vulnerable › Vulnerabilities

CVE-2024-12885: Connections Business Directory <= 10.4.66 - Authenticated (Admin+) Arbitrary Directory Deletion

• Severity: medium (CVSS 6.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.6% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2025-01-25 · updated 2026-06-17
• Weakness: CWE-22

Description

The Connections Business Directory plugin for WordPress is vulnerable to arbitrary directory deletion due to insufficient file path validation when deleting a connections image directory in all versions up to, and including, 10.4.66. This makes it possible for authenticated attackers, with Administrator-level access and above, to delete arbitrary folders on the server and all their content.

Affected products

• shazahm1hotmailcom Connections Business Directory: through 10.4.66

References

• https://wordpress.org/plugins/connections/
• https://www.wordfence.com/threat-intel/vulnerabilities/id/25e0c269-55c2-49f0-96bb-ae2696e2cea8?source=cve

Get alerted when CVE-2024-12885 or the next vulnerability affects your stack