CVE-2026-89271: CWE-434 Unrestricted Upload of File with Dangerous Type in WP-BusinessDirectory

The WP-BusinessDirectory plugin for WordPress, through version 4.0.2, has a CWE-434 vulnerability involving unrestricted upload of files with dangerous types. An unauthenticated upload handler does not restrict file types or destination paths, enabling attackers to write arbitrary files anywhere on the server. Despite this, default server settings do not allow these files to be executed, mitigating the risk of remote code execution.

Attackers can upload arbitrary files to the server without authentication, potentially leading to unauthorized file writes. While code execution is not possible on default server configurations, the vulnerability could be leveraged for other malicious purposes such as defacement, data manipulation, or denial of service depending on server setup.

No official patch or fix information is provided. Users should monitor the vendor advisory for updates. Until a fix is available, consider restricting file upload permissions, disabling the vulnerable upload handler if possible, or applying web server configurations to prevent execution of uploaded files. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.