CVE-2026-89271
5.3MediumPublished 13 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
- Impact
- Limited impact
- Weakness
- CWE-434
Impact
Unauthenticated remote attackers can write arbitrary files to arbitrary server locations. They only need network access to the web server to trigger the upload handler.
Root cause
The plugin's unauthenticated file upload handler lacks restrictions on uploaded file types and target destinations.
Affected systems
WP-BusinessDirectory WordPress plugin through 4.0.2
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Fix & remediation
No fixed version is specified in the advisory; deactivate and delete the plugin immediately or block access to its upload handler endpoint via web server rules.
$ wp plugin deactivate wp-business-directoryAI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
The WP-BusinessDirectory WordPress plugin through 4.0.2 does not restrict the type or destination of files saved by an unauthenticated upload handler, allowing unauthenticated attackers to write files with arbitrary content to arbitrary locations, though not to execute code on a default server configuration.