CVE-2025-53580CWE-266

WordPress Simple Business Directory Pro Plugin < 15.6.9 - Privilege Escalation Vulnerability

Critical · published August 20, 2025

CVSS v3.1
9.8
EPSS
0%
Percentile
29.3
In the wild
Unconfirmed
What it is

🔥 A sneaky privilege assignment issue lurks in Simple Business Directory Pro, allowing attackers to escalate their privileges with ease! Think of it like a VIP pass given out by mistake; suddenly, a regular visitor can waltz into the backstage area where the real magic happens, potentially wreaking havoc. 🎤 If exploited, this vulnerability could let an attacker gain admin-level access, allowing them to manipulate data, change settings, and even lock out legitimate users. This could lead to a catastrophic data breach or total loss of control over your directory—absolutely devastating! 🔥

Put simply

Think of it like a VIP pass given out by mistake; suddenly, a regular visitor can waltz into the backstage area where the real magic happens, potentially wreaking havoc. 🎤 The incorrect privilege assignment in Simple Business Directory Pro makes it possible for users to elevate their permissions beyond what they should have, impacting versions prior to 15.6.9.

What to do

If exploited, this vulnerability could let an attacker gain admin-level access, allowing them to manipulate data, change settings, and even lock out legitimate users. This could lead to a catastrophic data breach or total loss of control over your directory—absolutely devastating! 🔥 Patch to version 15.6.9 immediately to close this gaping hole. Review your user roles and permissions to ensure that no unauthorized access is granted, and consider conducting a full security audit to catch any other sneaky issues. 🛡️ You’ve got this! Follow these steps and you’ll keep your directory safe and sound! 🚀

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00367 · 29.3th percentile
Weakness
CWE-266 · Incorrect Privilege Assignment
Published
2025-08-20T08:03Z
EPSS history
Timeline
  • 20 AUG 08:03Z
    WordPress Simple Business Directory Pro Plugin < 15.6.9 - Privilege Escalation Vulnerability
    cvelistv5