# Business Directory Plugin – Easy Listing & Member Directories for WordPress <= 6.4.28 - Authenticated (Administrator+) Arbitrary File Upload via Directory Theme Upload

- **ID:** WPSEC-2026-1363
- **Plugin:** Business Directory Plugin – Easy Listing & Member Directories for WordPress (`business-directory-plugin`), https://wordpress.org/plugins/business-directory-plugin/
- **Affected versions:** all versions before 6.4.29
- **Fixed in:** 6.4.29 (Update to 6.4.29 or later.)
- **Severity:** Medium 6.6 (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H)
- **Weakness:** CWE-434
- **Usage among sites WPSec scans:** plugin Low, affected versions Low (as of 2026-10-21)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/business-directory-plugin
- **Fix released:** 2026-10-20
- **Published:** 2026-10-21
- **URL:** https://wpsec.com/vuln/WPSEC-2026-1363/

## Description

The Business Directory Plugin plugin for WordPress is vulnerable to arbitrary file upload via the Directory Theme upload feature in all versions up to, and including, 6.4.28. This is due to the upload_theme() handler checking only for the manage_options capability, not the install_themes capability, before it extracts an uploaded ZIP package into the plugin's themes directory without checking the file types inside. This makes it possible for authenticated attackers with administrator-level access to upload theme packages that contain arbitrary PHP files, which can lead to remote code execution. This matters where administrators lack the install_themes capability, such as site administrators on multisite networks or sites that set DISALLOW_FILE_MODS.

## References

- https://wpsec.com/vuln/WPSEC-2026-1363/
- https://plugins.svn.wordpress.org/business-directory-plugin/tags/6.4.29/
- https://wordpress.org/plugins/business-directory-plugin/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-1363/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.