{
 "id": "WPSEC-2026-1363",
 "url": "https://wpsec.com/vuln/WPSEC-2026-1363/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-1363/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1363/index.md",
 "title": "Business Directory Plugin – Easy Listing & Member Directories for WordPress <= 6.4.28 - Authenticated (Administrator+) Arbitrary File Upload via Directory Theme Upload",
 "description": "The Business Directory Plugin plugin for WordPress is vulnerable to arbitrary file upload via the Directory Theme upload feature in all versions up to, and including, 6.4.28. This is due to the upload_theme() handler checking only for the manage_options capability, not the install_themes capability, before it extracts an uploaded ZIP package into the plugin's themes directory without checking the file types inside. This makes it possible for authenticated attackers with administrator-level access to upload theme packages that contain arbitrary PHP files, which can lead to remote code execution. This matters where administrators lack the install_themes capability, such as site administrators on multisite networks or sites that set DISALLOW_FILE_MODS.",
 "plugin": {
  "slug": "business-directory-plugin",
  "name": "Business Directory Plugin – Easy Listing & Member Directories for WordPress",
  "full_name": "Business Directory Plugin – Easy Listing & Member Directories for WordPress",
  "wordpress_org": "https://wordpress.org/plugins/business-directory-plugin/",
  "advisories_url": "https://wpsec.com/vuln/plugin/business-directory-plugin/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/business-directory-plugin"
 },
 "type": "UPLOAD",
 "cwe": [
  "CWE-434"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 6.6,
  "vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "6.4.29",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 6.4.29"
  ]
 },
 "introduced_in": null,
 "fixed_in": "6.4.29",
 "remediation": "Update to 6.4.29 or later.",
 "fix_released": "2026-10-20T12:21:57+00:00",
 "published": "2026-10-21T12:44:50+00:00",
 "updated": "2026-10-21T12:33:46.984103+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-1363/",
  "https://plugins.svn.wordpress.org/business-directory-plugin/tags/6.4.29/",
  "https://wordpress.org/plugins/business-directory-plugin/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/business-directory-plugin",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "Low",
  "as_of": "2026-10-21"
 }
}