CVE-2026-6070 is an unauthenticated arbitrary file deletion vulnerability in the WP-BusinessDirectory WordPress plugin (up to version 4.0.1). The issue arises from insufficient validation of the _filename parameter in the remove() method of the JBusinessDirectoryControllerUpload class. The endpoint task=upload.remove is accessible without authentication and accepts the _filename parameter without sanitization, allowing path traversal sequences (../). When combined with the _path_type=2 parameter, attackers can traverse outside the plugin directory and invoke PHP's unlink() function on arbitrary files accessible to the web server, including wp-config.php and other critical files. This can lead to denial of service or further compromise due to deletion of essential files.

An unauthenticated attacker can delete arbitrary files on the server running the vulnerable plugin, including critical WordPress configuration files such as wp-config.php. This can cause denial of service, site downtime, or facilitate further attacks by disrupting the integrity of the WordPress installation. The vulnerability has a CVSS 3.1 score of 9.1, indicating critical impact with high exploitability and high impact on integrity and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the vulnerable endpoint if possible, and monitor for suspicious requests targeting the task=upload.remove endpoint. Avoid using the vulnerable plugin version 4.0.1 or earlier in production environments. Follow vendor advisories closely for updates and apply official patches once released.