CVE-2026-89271
UnknownSummary
The WP-BusinessDirectory WordPress plugin through 4.0.2 does not restrict the type or destination of files saved by an unauthenticated upload handler, allowing unauthenticated attackers to write files with arbitrary content to arbitrary locations, though not to execute code on a default server configuration.
Risk Assessment
An attacker can write malicious files to the server, potentially leading to website defacement, malware distribution, or other damage, even if code execution is not possible.
Recommendation
It is recommended to restrict access to the file upload handler, implement file type and destination validation, and update the plugin if a patch is available.
Other vulnerabilities in WP-BusinessDirectory
See all- CVE-2026-6070Critical
The WP-BusinessDirectory plugin for WordPress up to version 4.0.1 contains an unauthenticated arbitrary file deletion vulnerability. Insufficient path validation in the remove() method of the JBusinessDirectoryControllerUpload class allows an attacker to manipulate the _filename parameter and delete critical server files.
- CVE-2026-39591Critical
In WP-BusinessDirectory versions <= 4.0.0, there is a vulnerability that allows subscribers to upload arbitrary files.
Original NVD description (English source)
The WP-BusinessDirectory WordPress plugin through 4.0.2 does not restrict the type or destination of files saved by an unauthenticated upload handler, allowing unauthenticated attackers to write files with arbitrary content to arbitrary locations, though not to execute code on a default server configuration.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS