CVE-2026-39591
CriticalCVSS 9.9Exploitation Probability (EPSS)
Low risk40th percentile - higher than 40% of all known CVEs
Summary
In WP-BusinessDirectory versions <= 4.0.0, there is a vulnerability that allows subscribers to upload arbitrary files.
Risk Assessment
An attacker could exploit this vulnerability to upload malicious files, potentially leading to server takeover or data leakage.
Recommendation
It is recommended to update WP-BusinessDirectory to the latest version to mitigate this vulnerability.
Other vulnerabilities in WP-BusinessDirectory
See all- CVE-2026-6070Critical
The WP-BusinessDirectory plugin for WordPress up to version 4.0.1 contains an unauthenticated arbitrary file deletion vulnerability. Insufficient path validation in the remove() method of the JBusinessDirectoryControllerUpload class allows an attacker to manipulate the _filename parameter and delete critical server files.
- CVE-2026-89271Medium
The WP-BusinessDirectory WordPress plugin through 4.0.2 does not restrict the type or destination of files saved by an unauthenticated upload handler, allowing unauthenticated attackers to write files with arbitrary content to arbitrary locations, though not to execute code on a default server configuration.
Original NVD description (English source)
Subscriber Arbitrary File Upload in WP-BusinessDirectory <= 4.0.0 versions.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS