Business Directory Plugin – Easy Listing & Member Directories for WordPress <= 6.4.28 - Authenticated (Administrator+) Arbitrary File Upload via Directory Theme Upload
- ID
- WPSEC-2026-1363
- Plugin
- Business Directory Plugin – Easy Listing & Member Directories for WordPress (business-directory-plugin)
- Affected
- all versions before 6.4.29
- Remediation
- Update to 6.4.29 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
- Weakness
- CWE-434
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-10-21
- Attack surface
- Business Directory Plugin – Easy Listing & Member Directories for WordPress on WPSec AttackSurface
- Fix released
- Published
Description
The Business Directory Plugin plugin for WordPress is vulnerable to arbitrary file upload via the Directory Theme upload feature in all versions up to, and including, 6.4.28. This is due to the upload_theme() handler checking only for the manage_options capability, not the install_themes capability, before it extracts an uploaded ZIP package into the plugin's themes directory without checking the file types inside. This makes it possible for authenticated attackers with administrator-level access to upload theme packages that contain arbitrary PHP files, which can lead to remote code execution. This matters where administrators lack the install_themes capability, such as site administrators on multisite networks or sites that set DISALLOW_FILE_MODS.
References
- https://wpsec.com/vuln/WPSEC-2026-1363/
- https://plugins.svn.wordpress.org/business-directory-plugin/tags/6.4.29/
- https://wordpress.org/plugins/business-directory-plugin/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS