CVE-2026-6070 is an unauthenticated arbitrary file deletion vulnerability in the WP-BusinessDirectory WordPress plugin up to version 4.0.1. The issue arises from inadequate path validation in the remove() method of the JBusinessDirectoryControllerUpload class. The endpoint task=upload.remove accepts a _filename parameter without sanitization and a _path_type=2 parameter that sets the base directory to the plugin's site folder. Attackers can supply path traversal sequences (../) in _filename to traverse outside the intended directory and invoke PHP's unlink() function on arbitrary files accessible by the web server, including critical configuration files like wp-config.php. This vulnerability has a CVSS 3.1 score of 9.1, indicating critical severity with network attack vector, no privileges required, no user interaction, and high impact on integrity and availability.

An unauthenticated attacker can delete arbitrary files on the server hosting the vulnerable WordPress plugin. This can lead to denial of service by removing essential files such as wp-config.php or other critical server files accessible to the web server process. The integrity and availability of the affected system are severely impacted, potentially causing site downtime or loss of configuration data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the vulnerable endpoint if possible, and monitor for suspicious requests targeting task=upload.remove. Avoid using the affected plugin version (<=4.0.1) in production environments. Follow vendor updates for an official patch or temporary workaround.