CVE-2026-89271
WP-BusinessDirectory <= 4.0.2 - Unauthenticated Arbitrary File Write via uploadFile
- State
- Published
- Severity
- 5.3 Medium
- Published
- Oct 13, 2026
- Updated
- Oct 13, 2026
- Reserved
- Sep 11, 2026
Description
The WP-BusinessDirectory WordPress plugin through 4.0.2 does not restrict the type or destination of files saved by an unauthenticated upload handler, allowing unauthenticated attackers to write files with arbitrary content to arbitrary locations, though not to execute code on a default server configuration.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 5.3 Medium | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N | CISA-ADP |
Weaknesses
- CWE-434 Unrestricted Upload of File with Dangerous Type
Affected Products
| Product | Versions |
|---|---|
WP-BusinessDirectoryUnknown |
|
References
- https://wpscan.com/vulnerability/78b3ade9-1614-4040-87be-c43dbc50b79e/exploitvdb-entrytechnical-description
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.