CVE-2026-89271: WP-BusinessDirectory 0 through 4.0.2

Affected technology

WP-BusinessDirectory · 0 through 4.0.2
Vendor not specified by the source

Description’s affected range: through 4.0.2 does not restrict the type or destination of files saved by an unauthenticated upload handler

Component: Not specified by the source

What an attacker can do

Unauthenticated attackers can write files with arbitrary content to arbitrary locations, though not to execute code on a default server configuration.