Skip to main content
Meet us at Black Hat USA 2026— Las Vegas, August 1–6Book a Meeting
Mallory
Back to vulnerabilities
Unrated

Unauthenticated Arbitrary File Deletion in WP-BusinessDirectory <= 4.0.1

IdentifiersCVE-2026-6070CWE-22

CVE-2026-6070 affects the WP-BusinessDirectory plugin for WordPress in versions up to and including 4.0.1. The vulnerability is an unauthenticated arbitrary file deletion issue caused by insufficient path validation in the remove() method of the JBusinessDirectoryControllerUpload class. The plugin exposes the task=upload.remove endpoint through its frontend routing system without requiring authentication. The _filename parameter is accepted using a RAW filter without sanitization, and the helper function makePathFile() only normalizes directory separator characters rather than removing path traversal sequences such as ../. When an attacker supplies _path_type=2 to select the plugin site folder as the base path and includes traversal sequences in _filename, the code can escape the intended directory and pass an attacker-controlled path to PHP's unlink() function. This allows remote unauthenticated deletion of arbitrary files accessible to the web server process, including sensitive WordPress files such as wp-config.php or backup configuration files.

Share:
For your environment

Are you exposed to this one?

Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.

Start free trial
ANALYST BRIEF

Impact, mitigation & remediation

What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.

Impact

What an attacker gets, and what they’ve been doing with it.

Successful exploitation allows an unauthenticated remote attacker to delete arbitrary files on the server that are writable or otherwise deletable by the web server process. Impact can include denial of service against the WordPress site, destruction of plugin or application files, deletion of configuration files such as wp-config.php, loss of application availability, and potential follow-on compromise opportunities caused by forced reinstallation or recovery workflows. The issue does not by itself provide code execution, but deletion of critical files can severely disrupt operations and may facilitate broader compromise depending on the environment.

Mitigation

If you can’t patch tonight, do this now.

Until a patch is applied, disable or remove the WP-BusinessDirectory plugin to eliminate exposure. If immediate removal is not possible, restrict access to the vulnerable frontend route where feasible using WAF or web server rules, monitor for requests containing task=upload.remove, _path_type=2, or traversal patterns in _filename, and harden filesystem permissions so the web server account cannot delete sensitive files such as wp-config.php or other critical application assets. Additional monitoring for unexpected file deletions and integrity changes is advisable.

Remediation

Patch, then assume compromise.

Update WP-BusinessDirectory to a fixed version if one is available beyond 4.0.1. If no patched version is available, remove or disable the plugin, especially if it is not operationally required. The vulnerable code path should be corrected by enforcing authentication and authorization on the upload.remove action, rejecting path traversal sequences, canonicalizing paths before use, constraining file operations to an allowlisted directory, and verifying that the resolved path remains within the intended base directory before calling unlink().
PUBLIC EXPLOITS

Exploits

No public exploits tracked yet. Mallory keeps watching.

VALID 0 / 0 TOTALView more in app

No public exploit code observed for this vulnerability.

ACTIVITY FEED

Recent activity

8 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

8 SOURCESView more in app
What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which adversaries are exploiting it right now, which detections to deploy, and what to do tonight.
Start free trial
Exposure mapping

Query your assets running an affected version, and investigate the blast radius.

Threat actor evidence

Every observed campaign linking this CVE to a named adversary.

Associated malware

Malware families riding this exploit, with evidence and IOCs.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

Vendor-by-vendor mapping

Cross-references every affected SKU, including bundled OEM variants.

Social activity7

Community discussion across Reddit, Mastodon, and other social sources.

EXTERNAL REFERENCES
MITRE CVE
cve.org · CVE-2026-6070
NVD
nvd.nist.gov/vuln/detail/CVE-2026-6070
MITRE CWE · CWE-22
cwe.mitre.org