CVE-2026-39591 CMSJunkie – WordPress Business Directory Plugins CVE debrief

Who should care

WordPress site administrators, security teams, and IT professionals responsible for managing WordPress installations with the WP-BusinessDirectory plugin should assess exposure and apply patches or updates as necessary.

Why it matters

CVE-2026-39591 is a critical vulnerability in the WP-BusinessDirectory plugin for WordPress, allowing subscribers to upload arbitrary files. WordPress site administrators and security teams should assess exposure and apply patches or updates as necessary to prevent potential unauthorized file uploads, code execution, or data breaches. The vulnerability requires immediate attention and verification of subscriber privileges and access controls.

• Potential unauthorized file uploads
• Possible code execution or data breaches
• Required verification of subscriber privileges and access controls
• Need for immediate patching or updates

Technical summary

The WP-BusinessDirectory plugin for WordPress has a critical vulnerability allowing subscribers to upload arbitrary files. This issue affects versions up to 4.0.0 and has a CVSS score of 9.9. The vulnerability is tracked as CVE-2026-39591.

Defensive priority

Immediate attention is required to assess exposure and apply patches for WP-BusinessDirectory plugin versions up to 4.0.0.

Recommended defensive actions

• Assess exposure of WP-BusinessDirectory plugin versions up to 4.0.0
• Apply patches or updates for WP-BusinessDirectory plugin
• Monitor for suspicious file uploads or activity
• Review subscriber privileges and access controls

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, but additional information on affected versions and remediation is limited.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.