medium5.3
CVE-2026-89271
The WP-BusinessDirectory WordPress plugin through 4.0.2 does not restrict the type or destination of files saved by an unauthenticated upload handler, allowing…
Impact
The WP-BusinessDirectory WordPress plugin through 4.0.2 does not restrict the type or destination of files saved by an unauthenticated upload handler, allowing unauthenticated attackers to write files with arbitrary content to arbitrary locations, though not to execute code on a default server configuration.
Affected products
| Product | Affected versions |
|---|---|
| WP-BusinessDirectory WordPress Plugin | through 4.0.2 |
Versions were read from the advisory text. No structured product data has been published for this record yet.