CVE-2024-12885: SHAZAHM1HOTMAILCOM Connections Business Directory

Medium severity, CVSS 6.5. EPSS: 0.6% chance of exploitation in the next 30 days.

The Connections Business Directory plugin for WordPress is vulnerable to arbitrary directory deletion due to insufficient file path validation when deleting a connections image directory in all versions up to, and including, 10.4.66. This makes it possible for authenticated attackers, with Administrator-level access and above, to delete arbitrary folders on the server and all their content.

Affected products

• SHAZAHM1HOTMAILCOM Connections Business Directory: up to and including 10.4.66

Published 2025-01-25. Last modified 2026-06-17.