CVE-2026-89271: WP-BusinessDirectory <= 4.0.2 - Unauthenticated Arbitrary File Write via uploadFile
Published Oct 13, 2026
·Updated
The WP-BusinessDirectory WordPress plugin through 4.0.2 does not restrict the type or destination of files saved by an unauthenticated upload handler, allowing unauthenticated attackers to write files with arbitrary content to arbitrary locations, though not to execute code on a default server configuration.
Affected Software
1 affected component
WordPress WP-BusinessDirectory<=4.0.2
Event History
Oct 13, 2026
CVE Published
via MITRE·06:00 AM
Data Sourced
via MITRE·06:00 AM
DescriptionWeakness
Data Sourced
via NVD·06:17 AM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Who can exploit this issue?
Unauthenticated attackers can exploit the vulnerable upload handler; no login is required.
2
Can this lead to code execution on a default server configuration?
The provided information states that arbitrary files can be written, but code execution is not possible on a default server configuration.
3
What versions are affected?
WP-BusinessDirectory through version 4.0.2 is affected.