PT-2026-54482 · WordPress · Wp-Businessdirectory
CVSS v3.1
9.1
Critical
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
WP-BusinessDirectory versions prior to 4.0.2
Description
Unauthenticated attackers can delete arbitrary files on the server due to insufficient path validation in the
remove() method of the JBusinessDirectoryControllerUpload class. The 'task=upload.remove' endpoint is accessible without authentication. By providing a filename parameter containing path traversal sequences (../) and setting the path type parameter to 2, an attacker can bypass directory restrictions and trigger the unlink() function on critical files, such as wp-config.php or wp-config-backup.php.Recommendations
Update WP-BusinessDirectory to version 4.0.2 or later.
Restrict access to the 'task=upload.remove' endpoint to prevent unauthenticated requests.
Avoid using the
filename parameter in the 'task=upload.remove' endpoint until the software is updated.Fix
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Wp-Businessdirectory