CVE-2026-39591 CRITICAL

CVE-2026-39591: WordPress WP-BusinessDirectory plugin <= 4.0.0 - Arbitrary File Upload vulnerability

Vendor Cmsjunkie – Wordpress Business Directory Plugins
Product WP-BusinessDirectory
Weakness CWE-434 · Unrestricted file upload
Published June 15, 2026
Last update June 15, 2026
View on NVD All CVEs

CVSS base score

9.9/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality High
Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

What the vulnerability does

01Description

Subscriber Arbitrary File Upload in WP-BusinessDirectory <= 4.0.0 versions.

Explanation of Vulnerability in Simple Terms

02Summary

WP-BusinessDirectory versions up to 4.0.0 allow authenticated users to upload files without proper validation. An attacker with a low-privilege account can upload malicious files, potentially gaining control over the site. The vulnerability affects confidentiality, integrity, and availability. Update to version 4.0.2 or later.

What an attacker can do

03Attacker Capabilities

Upload malicious files and run code on the site with a low-privilege account.

Potential impact on your site

04Site Impact

A low-privilege user can upload files to compromise your site's security and data.

Conditions required to exploit

05Prerequisites

Attacker must have a low-privilege user account on the WordPress site.

Key dates

06Disclosure timeline

June 15, 2026 CVE published

Related vulnerabilities

08Related CVE

CVE-2025-13067 Royal Addons for Elementor <= 1.7.1049 - Authenticated (Author+) Arbitrary File Upload via main.php Upload Bypass CVE-2026-5364 Drag and Drop File Upload for Contact Form 7 <= 1.1.3 - Unauthenticated Arbitrary File Upload via sanitize_file_name Bypass CVE-2026-1555 WebStack <= 1.2024 - Unauthenticated Arbitrary File Upload CVE-2026-3891 Pix for WooCommerce <= 1.5.0 - Unauthenticated Arbitrary File Upload CVE-2026-27043 WordPress Photography theme < 7.7.6 - Arbitrary File Upload vulnerability