Unauthenticated Arbitrary File Deletion in WP-BusinessDirectory Plugin for WordPress

CVE-2026-6070

What is CVE-2026-6070?

The WP-BusinessDirectory plugin for WordPress contains a vulnerability that permits unauthenticated attackers to execute arbitrary file deletions. This issue arises from inadequate path validation within the remove() method of the JBusinessDirectoryControllerUpload class, allowing direct access to the task=upload.remove endpoint without any authentication. Attackers can exploit the _filename parameter, which is not properly sanitized, to introduce path traversal sequences. This enables them to manipulate the file path, potentially targeting sensitive files such as wp-config.php. As a result, malicious entities can delete crucial files on the server, posing a significant security risk for affected WordPress sites.

References