{"@context":"https://openvex.dev/ns/v0.2.0","@id":"https://database.harborguard.co/cve/CVE-2026-6070/vex.json","author":"HarborGuard Database","role":"Document Creator","timestamp":"2026-07-01T04:32:27.988Z","version":1,"tooling":"HarborGuard Database (https://database.harborguard.co)","statements":[{"vulnerability":{"name":"CVE-2026-6070","@id":"https://www.cve.org/CVERecord?id=CVE-2026-6070","description":"The WP-BusinessDirectory plugin for WordPress is vulnerable to Unauthenticated Arbitrary File Deletion in versions up to and including 4.0.1. This is due to insufficient path validation in the remove() method of the JBusinessDirectoryControllerUpload class. The task=upload.remove endpoint is accessible without authentication via the plugin's frontend routing system. The _filename parameter is accepted with RAW filter (no sanitization), and the helper function makePathFile() only normalizes direc"},"products":[{"@id":"cpe:2.3:a:cmsjunkie:wp-businessdirectory_–_business_directory_plugin_for_wordpress:*:*:*:*:*:*:*:*","identifiers":{"cpe23":"cpe:2.3:a:cmsjunkie:wp-businessdirectory_–_business_directory_plugin_for_wordpress:*:*:*:*:*:*:*:*"}}],"status":"affected","action_statement":"No fixed version is published yet; monitor the upstream advisory.","timestamp":"2026-07-01T04:32:27.988Z"}]}