The WP-BusinessDirectory plugin for WordPress is vulnerable to Unauthenticated Arbitrary File Deletion in versions up to and including 4.0.1. This is due to ins…

The WP-BusinessDirectory plugin for WordPress (versions up to and including 4.0.1) contains a critical unauthenticated arbitrary file deletion vulnerability tracked as CVE-2026-6070. The flaw resides in the remove() method of the JBusinessDirectoryControllerUpload class, where the task=upload.remove endpoint is publicly accessible without authentication. The _filename parameter accepts raw, unsanitized input, and the makePathFile() helper function fails to strip path traversal sequences (../). By combining the _path_type=2 parameter with path traversal sequences in _filename, an unauthenticated attacker can escape the plugin directory and invoke PHP's unlink() on arbitrary server files. Critical files such as wp-config.php and wp-config-backup.php are at risk of deletion. Successful exploitation could render a WordPress site inoperable or expose sensitive configuration data. No authentication or privileges are required to exploit this vulnerability.