CVE-2024-4443 is a Critical (CVSS 9.8) time based SQL injection in the Business Directory Plugin for WordPress, in versions up to and including 6.4.2. The listingfields parameter is the entry point, and no login is needed. Update to a version newer than 6.4.2.
What's affected
- Product: Business Directory Plugin, Easy Listing Directories for WordPress.
- Affected versions: up to and including 6.4.2.
- Fixed version: not named in the record. A Trac changeset (3089626) touches the field type select class, and I did not fetch it. Use the current release.
- Severity: Critical, CVSS 9.8, no privileges and no interaction.
- Attack style: time based, meaning an attacker infers data from how long queries take rather than from direct output.
- Exploitation: KEV is false.
How to check if you're exposed
Check the version:
wp plugin get business-directory-plugin --field=version
Time based injection leaves a log pattern. Look for requests that carried a listingfields parameter and took unusually long to complete, and for spikes in database load that match them. Your web server log format may include request duration. If it does not, add it.
What to do now
- Check the plugin version on every site.
- Update the plugin to the latest release.
- Add request duration to access logs, and look for slow requests involving listingfields.
- Review database users and give the WordPress account only the privileges it needs.
- If you have evidence of abuse, rotate credentials stored in the database and force password resets.
Why it matters
The record maps this to CWE-89, SQL injection. The plugin adds the listingfields value to a query without escaping it and without a prepared statement, so an attacker can append SQL.
Time based attacks are slow but need no visible output, so they work even when the page shows nothing. The fix remains the same as always: prepared statements that keep data separate from query structure.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
What does time based mean?
The attacker asks the database yes or no questions and watches how long it takes to answer, so no output is needed.
Does the attacker need a login?
No. The record says unauthenticated attackers can use it.
Scan your own dependencies
Safeguard's free in-browser dependency scan at gold.safeguard.sh/scan checks a manifest against known advisories, and the Gold directory keeps this record's details in one place.
Sources
The NVD record for CVE-2024-4443 (published 2024-05-22) supplied the description, score and weakness data. Pages marked fetched were read for this post. The others are listed in the record and were not read.
Last reviewed: 19 October 2026.
