This vulnerability (CVE-2026-39591) in CMSJunkie's WP-BusinessDirectory plugin (versions <=4.0.0) permits users with subscriber-level privileges to upload arbitrary files without adequate validation or restriction on file types. This unrestricted file upload can be exploited to execute malicious code or disrupt the system, resulting in a complete compromise of confidentiality, integrity, and availability. The CVSS 3.1 base score is 9.9, reflecting its critical severity with network attack vector, low attack complexity, and no user interaction required. The vulnerability is publicly known but no official fix or patch has been released as of the publication date.

Successful exploitation allows an attacker with subscriber privileges to upload and potentially execute malicious files on the affected WordPress site. This can lead to full system compromise including unauthorized data access, data modification, and service disruption. The high CVSS score (9.9) indicates critical impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, consider restricting subscriber upload permissions or disabling file uploads for subscribers as a temporary mitigation. Monitor official CMSJunkie channels for updates and apply patches promptly once available.