File Upload Vulnerability in WP-BusinessDirectory Plugin by WordPress
CVE-2026-89271

Currently unrated

Key Information:

Vendor

WordPress
Status
WP-businessdirectory
Vendor
CVE Published:
13 October 2026

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2026-89271?

The WP-BusinessDirectory plugin for WordPress, up to version 4.0.2, features a flaw in its unauthenticated upload handler that does not adequately limit the type or destination of files that can be uploaded. This oversight permits unauthenticated users to upload files containing arbitrary content to any location on the server, although executing uploaded code under default server configurations is not possible. This issue poses a significant security risk, as it could lead to unauthorized data manipulation or exposure.

Affected Version(s)

WP-BusinessDirectory 0 <= 4.0.2

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2026-89271 - Proof of Concept

References

https://wpscan.com/vulnerability/78b3ade9-1614-4040-87be-...
exploitvdb-entrytechnical-description

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

Sai Praneeth Koti
WPScan
.