The WP‑BusinessDirectory WordPress plugin allows unauthenticated users to delete files on the web server. The flaw originates from missing validation of the _filename parameter in the upload.remove endpoint; the parameter is accepted raw, and the internal helper does not strip ../ path traversal. When the caller also supplies _path_type=2, the function resolves to the plugin’s site directory, enabling traversal beyond it and leading the PHP unlink() function to remove any file readable by the web process. An attacker could therefore target critical files such as wp-config.php, thus destroying site configuration or exposing sensitive data. This weakness, classified as CWE‑73, allows drastic integrity loss and potential service disruption. The impact is purely destructive and requires no further authentication.

All installations of the WP‑BusinessDirectory plugin from cmsjunkie, up to and including major version 4.0.1, are affected. The vulnerability exists in the upload.php controller responsible for handling file uploads and deletes. No other plugin versions are impacted, and upgrades beyond 4.0.1 automatically include the fix.

The CVSS score of 9.1 classifies the vulnerability as critical. The EPSS score is unavailable, but the absence of a KEV listing does not mitigate the high severity. An attacker only needs to send an HTTP request to the task=upload.remove endpoint with the specially crafted _filename and _path_type parameters; no user authentication or privileges are required. The lack of input sanitization combined with PHP's native unlink operation makes exploitation straightforward through a web browser or automation tools.