CVE-2025-13414

Description

The Chamber Dashboard Business Directory plugin for WordPress is vulnerable to unauthorized data export due to a missing capability check on the cdash_watch_for_export() function in all versions up to, and including, 3.3.11. This makes it possible for unauthenticated attackers to export business directory information, including sensitive business details.

PUBLISHED Reserved 2025-11-19 | Published 2025-11-25 | Updated 2025-11-25 | Assigner Wordfence

Problem types

CWE-862 Missing Authorization

Product status

Timeline

Credits

Abhirup Konwar finder

References

www.wordfence.com/...-a104-464a-bb57-2c3c73ff9415?source=cve

plugins.trac.wordpress.org/...ss-directory/trunk/options.php

plugins.trac.wordpress.org/...ectory/tags/3.3.11/options.php

cve.org (CVE-2025-13414)

nvd.nist.gov (CVE-2025-13414)

Download JSON