Executive brief
The WP-BusinessDirectory plugin for WordPress, which is used to create business listings and directories, contains a critical security flaw. This vulnerability allows users with basic 'Subscriber' accounts to upload malicious files, such as web shells or backdoors, to the server. If exploited, an attacker could take complete control of the website, leading to data theft, site defacement, or a total service outage.
Technical details
The WP-BusinessDirectory plugin for WordPress (versions up to and including 4.0.0) suffers from an unrestricted file upload vulnerability (CWE-434). The flaw resides in the plugin's failure to properly validate file types and extensions during the upload process. An attacker with Subscriber-level authentication can bypass security checks to upload executable files, such as PHP scripts, to the web server. Because the vulnerability allows for a scope change (S:C), an attacker can achieve full remote code execution (RCE) and potentially compromise the underlying server environment. The issue is resolved in version 4.0.1.
Affected products
- WP-BusinessDirectory WP-BusinessDirectory <= 4.0.0
Timeline
- 2026-02-13: other: Vulnerability reported by researcher Jarno Vos
- 2026-04-08: advisory: Initial advisory published by Patchstack
- 2026-06-15: disclosed: CVE published to NVD
- 2026-04-08: patched: Version 4.0.1 released to address the vulnerability