Threat database

CVE-2026-39591 is a critical vulnerability in the WP-BusinessDirectory plugin for WordPress by CMSJunkie, affecting versions up to and including 4.0.0. It allows subscribers to upload arbitrary files without proper restrictions, leading to potential full compromise of confidentiality, integrity, and availability of the affected system. The vulnerability is categorized under CWE-434 (Unrestricted Upload of File with Dangerous Type). No official patch or remediation guidance is currently provided by the vendor.