[ CVE-2026-89271 · Published 13 Oct 2026 ]
Vulnerability in Unknown WP-BusinessDirectory
CVSS 5.3
EPSS <1%No fix listed yet
[ Description ]Official description
The WP-BusinessDirectory WordPress plugin through 4.0.2 does not restrict the type or destination of files saved by an unauthenticated upload handler, allowing unauthenticated attackers to write files with arbitrary content to arbitrary locations, though not to execute code on a default server configuration.
[ Fixes ]Fixes and patches
No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.