The vulnerability allows an attacker to construct a request that bypasses the plugin’s directory restriction, resulting in deletion of files on the host filesystem. This can lead to loss of critical data, website defacement, or denial of service by removing essential configuration files. The weakness is a classic path traversal flaw (CWE-22) affecting the integrity and availability of the affected site.

The issue affects the WP-BusinessDirectory plugin developed by CMSJunkie for WordPress, versions from the earliest released through 3.1.2 inclusive. Any WordPress installation running WP-BusinessDirectory 3.1.2 or earlier is potentially vulnerable. No further sub‑version details are provided.

The CVSS score of 8.6 indicates a high‑severity flaw. The EPSS score of less than 1% suggests that, in current threat landscapes, the probability of exploitation is low, and the vulnerability is not listed in CISA’s KEV catalog. However, because the flaw can be triggered simply by accessing a crafted URL, a determined attacker could exploit it without needing additional privileges. The lack of listing in KEV does not mitigate the risk, as the potential impact remains significant.