This vulnerability resides in the uploadFile handler of WP‑BusinessDirectory up to version 4.0.2. The handler accepts any file type and writes it to an unrestricted destination path without authentication or access controls. An attacker can therefore store any content, including scripts, in arbitrary locations on the server. While executing code from the default configuration is prevented, the placement of malicious files can later be leveraged if the server or other application components unintentionally execute them, presenting a potential escalation path. The flaw aligns with CWE‑434 and CWE‑22.

Affected systems are WordPress installations that have the WP‑BusinessDirectory plugin version 4.0.2 or older. The plugin lacks vendor attribution in the CNA data; users should verify the installed version and ensure that the plugin is removed or replaced if update is not available.

No EPSS data is available, and the CVE is not listed in CISA KEV, implying little or no public exploitation evidence. The attack vector is purely local to the web application, requiring only HTTP requests to the upload endpoint; no authentication is needed. Because the flaw does not directly enable remote code execution on a default server, the severity is moderate, but the ability to write arbitrary files could lead to data tampering, disclosure, or later code execution if the server is misconfigured. The CVSS score is not provided; administrators should treat the vulnerability as high risk due to the unrestricted write capability.