What is the CVSS score of CVE-2026-6070?

CVE-2026-6070 has a CVSS 3.1 base score of 9.1 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of WP-BusinessDirectory are affected by CVE-2026-6070?

The WP-BusinessDirectory plugin for WordPress (versions 4.0.1 and earlier) contains a critical vulnerability allowing unauthenticated attackers to delete essential site files, including the WordPress…

How to fix or mitigate CVE-2026-6070?

Within 24 hours: Scan all WordPress installations for WP-BusinessDirectory version 4.0.1 or earlier; immediately disable the plugin on all affected sites. Within 7 days: Review web server and WordPress access logs from the past 90 days for suspicious requests to /wp-admin/admin-ajax.php with task=upload.remove and unusual filename parameters; deploy WAF rules to block path traversal patterns (../, ..\ sequences) targeting upload endpoints. Within 30 days: Subscribe to WP-BusinessDirectory security advisories; upgrade to the patched version within 24 hours of vendor release.

WP-BusinessDirectory CVE-2026-6070

EUVD-2026-40908 CRITICAL

External Control of File Name or Path (CWE-73)

2026-07-01 Wordfence

GHSA-xgpp-v9mr-6fg2

PHP WordPress Path Traversal Wordpress Plugin Wp Businessdirectory Business Directory Plugin For Wordpress Cmsjunkie

9.1

CVSS 3.1 · Vendor: Wordfence

Severity by source

Vendor (Wordfence) PRIMARY

9.1 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

vuln.today AI

9.1 CRITICAL

Unauthenticated network endpoint with trivial ../ traversal (AV:N/AC:L/PR:N/UI:N); arbitrary file deletion harms integrity and availability (I:H/A:H) but reveals no data (C:N).

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Wordfence).

CVSS VectorVendor: Wordfence

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 01, 2026 - 05:23 vuln.today

CVE Published

Jul 01, 2026 - 04:32 nvd

CRITICAL 9.1

DescriptionCVE.org

The WP-BusinessDirectory plugin for WordPress is vulnerable to Unauthenticated Arbitrary File Deletion in versions up to and including 4.0.1. This is due to insufficient path validation in the remove() method of the JBusinessDirectoryControllerUpload class. The task=upload.remove endpoint is accessible without authentication via the plugin's frontend routing system. The _filename parameter is accepted with RAW filter (no sanitization), and the helper function makePathFile() only normalizes directory separator characters without stripping path traversal sequences (../). When combined with the _path_type=2 parameter, which sets the base directory to the plugin's site folder, an attacker can supply a _filename value containing ../ sequences to traverse outside the plugin directory and call PHP's unlink() on arbitrary files - including wp-config.php, wp-config-backup.php, or other critical server files accessible to the web server process. This makes it possible for unauthenticated attackers to delete arbitrary files on the server.

Articles & Coverage 2

News 16 New WordPress Vulnerabilities - 2 Critical, 14 High, 4 With POC Jul 02, 2026 News Critical Arbitrary File Deletion in WordPress WP-BusinessDirectory Plugin - CVE-2026-6070 Jul 01, 2026

AnalysisAI

Arbitrary file deletion in the WP-BusinessDirectory (Business Directory) plugin for WordPress (versions ≤ 4.0.1) lets unauthenticated remote attackers delete any file the web server can access, including wp-config.php. The flaw stems from the frontend-accessible task=upload.remove endpoint accepting an unsanitized _filename parameter that permits ../ path traversal. No public exploit is identified at time of analysis, but the CVSS 9.1 rating and trivial exploitation (network, no auth, no user interaction) make it high priority; deleting wp-config.php can force WordPress into its installer, enabling site takeover.

Technical ContextAI

The vulnerability lives in the remove() method of the JBusinessDirectoryControllerUpload class (site/controllers/upload.php) exposed through the plugin's frontend routing as task=upload.remove. WordPress plugins that build their own file-management endpoints must sanitize file paths before filesystem operations; here the _filename parameter is read with a RAW filter, and the helper makePathFile() only normalizes directory-separator characters without stripping ../ traversal sequences. Combined with _path_type=2 (which anchors the base directory to the plugin's site folder), the attacker-controlled path is passed to PHP's unlink(). This is a textbook CWE-73 (External Control of File Name or Path) issue. Affected CPE: cpe:2.3:a:cmsjunkie:wp-businessdirectory_-_business_directory_plugin_for_wordpress, i.e. the CMSJunkie-authored plugin.

RemediationAI

No fixed version is stated in the provided data, so at time of analysis treat this as: no vendor-released patched version independently confirmed - check the Wordfence advisory (https://www.wordfence.com/threat-intel/vulnerabilities/id/d7d68f43-2a57-4352-8aae-0657b386ac7c?source=cve) and the WordPress.org plugin page for a release above 4.0.1 and upgrade to it as soon as available. Until a fixed release is confirmed, the safest control is to deactivate and remove the WP-BusinessDirectory plugin (side effect: directory-listing functionality goes offline). If the plugin must stay active, use a WAF or web-server rule to block or filter requests to the plugin's frontend endpoint carrying task=upload.remove and reject any _filename value containing ../ traversal sequences (side effect: may break legitimate file-removal within the plugin admin UI). As defense in depth, ensure the web-server process user cannot write to or delete wp-config.php and other critical files, and maintain off-host backups so a deletion is recoverable.