CVE-2026-89271 WP-BusinessDirectory <= 4.0.2 - Unauthenticated Arbitrary File Write via uploadFile
Unauthenticated attackers can write arbitrary files to arbitrary locations in the WP-BusinessDirectory WordPress plugin.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-89271?
CVE-2026-89271 is a medium-severity vulnerability in Unknown WP-BusinessDirectory, published on 13 Oct 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The WP-BusinessDirectory WordPress plugin through 4.0.2 does not restrict the type or destination of files saved by an unauthenticated upload handler, allowing unauthenticated attackers to write files with arbitrary content to arbitrary locations, though not to execute code on a default server configuration.
Weakness: CWE-434
Which versions are affected by CVE-2026-89271?
How do I fix CVE-2026-89271?
No fix has been published for CVE-2026-89271 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-89271 being exploited?
There is no known exploitation of CVE-2026-89271 in the wild and no public exploit code.
Sources
Also known as GHSA-mr4c-8644-ggh2.