CVE-2026-39591: WordPress WP-BusinessDirectory plugin <= 4.0.0 - Arbitrary File Upload vulnerability

Synopsis

An arbitrary file upload vulnerability exists in the WP-BusinessDirectory WordPress plugin (versions 4.0.0 and earlier). Any authenticated user with a low-privilege subscriber account can upload arbitrary files to the server over the network, with no victim interaction required. Successful exploitation gives an attacker full remote code execution, read and write access to all data, and the ability to crash or take over the affected service. HarborGuard is tracking this advisory and will make a patched-image rebuild available the moment an upstream fix is published.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable endpoint is exposed over the network, meaning an attacker must be able to reach the WordPress installation via HTTP/HTTPS to exploit this vulnerability.

• AuthenticationRequired

  A low-privilege subscriber account is sufficient; no administrative credentials are needed, making this accessible to any registered user on the WordPress site.

• Victim interactionNot required

  The attacker can complete the exploit entirely without any action from another user or administrator.

• Attack complexityDetail

  The exploit is reliable and condition-free, requiring no race conditions, specific memory layout, or other environmental factors to succeed.

Blast Radius

• Attacker uploads and executes arbitrary server-side code, achieving full remote code execution on the host running WordPress.
• Attacker reads all files and database content accessible to the web server process, including stored credentials, user data, and private business directory records.
• Attacker modifies or deletes files and database rows, enabling defacement, data destruction, or backdoor implantation.
• Attacker can crash or destabilize the WordPress service, causing a denial of service for legitimate users.