{"id":"CVE-2024-12885","aliases":["EUVD-2024-51169","GHSA-gwmg-6pqg-9h9j"],"status":"published","title":"Connections Business Directory \u003c= 10.4.66 - Authenticated (Admin+) Arbitrary Directory Deletion","description":"The Connections Business Directory plugin for WordPress is vulnerable to arbitrary directory deletion due to insufficient file path validation when deleting a connections image directory in all versions up to, and including, 10.4.66. This makes it possible for authenticated attackers, with Administrator-level access and above, to delete arbitrary folders on the server and all their content.","severity":{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00595,"percentile":0.48784,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-22"],"published":"2025-01-25T07:24:14Z","modified":"2026-06-17T07:00:42Z","products":[{"vendor":"shazahm1hotmailcom","product":"connections business directory"}],"references":[{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/25e0c269-55c2-49f0-96bb-ae2696e2cea8?source=cve"},{"url":"https://wordpress.org/plugins/connections/"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-12885"},{"url":"https://wordpress.org/plugins/connections"},{"url":"https://github.com/advisories/GHSA-gwmg-6pqg-9h9j"}],"sources":{"cve":[{"id":"CVE-2024-12885","title":"Connections Business Directory \u003c= 10.4.66 - Authenticated (Admin+) Arbitrary Directory Deletion","description":"The Connections Business Directory plugin for WordPress is vulnerable to arbitrary directory deletion due to insufficient file path validation when deleting a connections image directory in all versions up to, and including, 10.4.66. This makes it possible for authenticated attackers, with Administrator-level access and above, to delete arbitrary folders on the server and all their content.","status":"published","published":"2025-01-25T07:24:14.745Z","modified":"2026-04-08T16:42:30.94Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H","level":"medium","assessor":"cna"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:34:12.635756Z"}],"euvd":[{"id":"EUVD-2024-51169","description":"The Connections Business Directory plugin for WordPress is vulnerable to arbitrary directory deletion due to insufficient file path validation when deleting a connections image directory in all versions up to, and including, 10.4.66. This makes it possible for authenticated attackers, with Administrator-level access and above, to delete arbitrary folders on the server and all their content.","status":"published","published":"2025-01-25T07:24:14Z","modified":"2026-04-08T16:42:30Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H","level":"medium"}],"updated_at":"2026-11-02T19:25:05.655339Z"}],"ghsa":[{"id":"GHSA-gwmg-6pqg-9h9j","title":"The Connections Business Directory plugin for WordPress is vulnerable to arbitrary directory...","description":"The Connections Business Directory plugin for WordPress is vulnerable to arbitrary directory deletion due to insufficient file path validation when deleting a connections image directory in all versions up to, and including, 10.4.66. This makes it possible for authenticated attackers, with Administrator-level access and above, to delete arbitrary folders on the server and all their content.","status":"published","published":"2025-01-25T09:30:54Z","modified":"2025-01-25T09:31:00Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H","level":"medium"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:59:40.658623Z"}],"nvd":[{"id":"CVE-2024-12885","description":"The Connections Business Directory plugin for WordPress is vulnerable to arbitrary directory deletion due to insufficient file path validation when deleting a connections image directory in all versions up to, and including, 10.4.66. This makes it possible for authenticated attackers, with Administrator-level access and above, to delete arbitrary folders on the server and all their content.","status":"published","published":"2025-01-25T08:15:08.633Z","modified":"2026-06-17T07:00:42.177Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H","level":"medium","assessor":"secondary"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:10:43.581383Z"}]}}