CVE-2026-6070: WP-BusinessDirectory Path Traversal Flaw

CVE-2026-6070 Overview

CVE-2026-6070 is an unauthenticated arbitrary file deletion vulnerability in the WP-BusinessDirectory plugin for WordPress. The flaw affects all versions up to and including 4.0.1. Attackers can abuse insufficient path validation in the remove() method of the JBusinessDirectoryControllerUpload class to delete arbitrary files on the server. Because the task=upload.remove endpoint is exposed without authentication, any remote actor can trigger deletion of critical files such as wp-config.php. Deleting wp-config.php typically forces WordPress into a setup state that an attacker can hijack to achieve full site takeover.

Critical Impact
Unauthenticated attackers can delete arbitrary files, including wp-config.php, enabling site takeover.

Affected Products

WordPress WP-BusinessDirectory plugin versions ≤ 4.0.1
WordPress installations using WP-BusinessDirectory 4.0.0 (trunk and tagged releases)
Any WordPress site with the vulnerable plugin activated

Discovery Timeline

2026-07-01 - CVE-2026-6070 published to NVD
2026-07-01 - Last updated in NVD database

Technical Details for CVE-2026-6070

Vulnerability Analysis

The vulnerability is a path traversal issue that results in arbitrary file deletion [CWE-73]. The plugin exposes a frontend routing endpoint at task=upload.remove that does not require authentication. This endpoint routes into the remove() method of JBusinessDirectoryControllerUpload, which uses attacker-controlled input to construct a file path passed to PHP's unlink().

The unauthenticated attack surface, combined with the lack of sanitization on the _filename parameter, allows remote attackers to delete files outside the plugin directory. Deletion of wp-config.php triggers the WordPress installer, which an attacker can complete against their own database to gain administrative control.

Root Cause

The plugin retrieves the _filename request parameter using the RAW filter, meaning no sanitization or normalization is applied. The helper function makePathFile() normalizes directory separator characters but does not strip ../ traversal sequences. When the _path_type=2 parameter is supplied, the base directory resolves to the plugin's site folder, and traversal sequences in _filename escape that base to reach any file readable by the web server user.

Attack Vector

An attacker sends an unauthenticated HTTP request to the plugin's frontend controller with task=upload.remove, _path_type=2, and a _filename value containing ../ sequences pointing at a target file such as ../../../wp-config.php. The controller resolves the path and invokes unlink() on the target. No user interaction, credentials, or prior access are required. Sensitive deletion targets include wp-config.php, wp-config-backup.php, plugin files, and any other file writable by the PHP process. See the Wordfence Vulnerability Analysis and the vulnerable upload.php source for technical details.

Detection Methods for CVE-2026-6070

Indicators of Compromise

HTTP requests to WordPress endpoints containing task=upload.remove combined with _path_type=2
Requests where the _filename parameter contains ../ or URL-encoded traversal sequences such as %2e%2e%2f
Missing wp-config.php or wp-config-backup.php files, or unexpected appearance of the WordPress /wp-admin/setup-config.php installer
Unexpected file deletion events in the WordPress document root or plugin directories

Detection Strategies

Inspect web server access logs for GET or POST requests referencing upload.remove and traversal patterns in query strings or POST bodies
Enable file integrity monitoring on the WordPress root, wp-content/plugins/wp-businessdirectory/, and configuration files
Alert on any process invoking unlink() against wp-config.php or files outside the expected plugin working directory

Monitoring Recommendations

Forward WordPress and web server logs to a centralized analytics platform for correlation of traversal patterns
Monitor for sudden appearance of the WordPress setup wizard, which indicates wp-config.php deletion
Track outbound requests from the site immediately after suspicious upload.remove traffic, which may indicate post-exploitation takeover

How to Mitigate CVE-2026-6070

Immediate Actions Required

Update the WP-BusinessDirectory plugin to a version later than 4.0.1 once released by the vendor
If no patched version is available, deactivate and remove the plugin from all WordPress sites
Restrict access to the plugin's frontend controller endpoints at the web server or WAF layer
Back up wp-config.php and other critical files to a location outside the web root

Patch Information

At the time of NVD publication on 2026-07-01, all versions up to and including 4.0.1 are affected. Site administrators should monitor the WP-BusinessDirectory plugin repository and the Wordfence advisory for a fixed release.

Workarounds

Block requests containing task=upload.remove at a web application firewall until a patch is applied
Deny requests where _filename contains .., %2e%2e, or backslash sequences
Set filesystem permissions so the PHP process cannot delete wp-config.php or files outside wp-content/uploads/
Enforce authentication in front of WordPress admin and plugin endpoints via reverse proxy rules where feasible

bash

# Example ModSecurity rule to block exploitation attempts
SecRule ARGS:task "@streq upload.remove" \
    "id:1026607,phase:2,deny,status:403,\
    msg:'Block WP-BusinessDirectory CVE-2026-6070 exploit attempt',\
    chain"
    SecRule ARGS:_filename "@rx (\.\.|%2e%2e)" "t:lowercase,t:urlDecodeUni"