WP-BusinessDirectory CVE debriefs

CVE-2026-89271

The WP-BusinessDirectory WordPress plugin through 4.0.2 has an unauthenticated upload handler that allows writing files with arbitrary content to arbitrary locations. This issue may allow unauthenticated attackers to write files to the server, potentially leading to various consequences. However, the CVE record does not provide information on code execution or other specific impacts.