Cmsjunkie Vulnerabilities and Affected Products
Vulnerabilities associated with WP-BusinessDirectory – Business directory plugin for WordPress.
Products
Clear product- ClassifiedsManager1 vulnerability
- J-BusinessDirectory1 vulnerability
- J-CruisePortal1 vulnerability
- JHotelReservation1 vulnerability
- MultipleHotelReservation1 vulnerability
- WP-BusinessDirectory – Business directory plugin for WordPress1 vulnerability
| Vulnerability | Title and context | CVSS | EPSS | PoCs | Signals | STIX action |
|---|---|---|---|---|---|---|
CVE-2026-6070CRITICAL | WP-BusinessDirectory <= 4.0.1 - Unauthenticated Arbitrary File Deletion via Path Traversal via '_filename' ParameterThe WP-BusinessDirectory plugin for WordPress is vulnerable to Unauthenticated Arbitrary File Deletion in versions up to and including 4.0.1. This is due to insufficient path validation in the remove() method of the JBusinessDirectoryControllerUpload class. The task=upload.remove endpoint is accessible without authentication via the plugin's frontend routing system. The _filename parameter is accepted with RAW filter (no sanitization), and the helper function makePathFile() only normalizes direc… CWE-73Jul 1, 2026 | CVSS9.1v3.1 | EPSS0.409% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |