CVE-2026-120518
Deferred Deferred - Pending Action

Arbitrary File Deletion in BuddyPress XProfile Image Field WordPress Plugin

Publication date: 2026-11-03

Last updated on: 2026-11-03

Assigner: Wordfence

Description
The BuddyPress XProfile Image Field plugin for WordPress is vulnerable to arbitrary file deletion in all versions up to, and including, 3.1.0. This is due to bpxp_image_field_update_on_user_activation() calling unlink() on a path built from visitor-supplied signup metadata with no realpath() resolution, no containment check against the profile-image directory and no extension allow-list. Submitting a zero-byte file with the 'field_N_hidden' parameter during registration makes the plugin store the raw value, which is then resolved against the document root when the pending signup is activated. This makes it possible for unauthenticated attackers to delete arbitrary files on the server, which can easily lead to remote code execution when the right file (such as wp-config.php) is deleted. Requires open registration and an image-type profile field on the signup form.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-03
Last Modified
2026-11-03
Generated
2026-11-03
AI Q&A
2026-11-03
EPSS Evaluated
N/A
NVD
CVE-2026-120518

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
kalengi BuddyPress XProfile Custom Image Field 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-22 The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The BuddyPress XProfile Image Field plugin for WordPress has a flaw in versions up to 3.1.0 that allows arbitrary file deletion. The vulnerability occurs because the plugin's user activation function uses unlink() on a path built from user-supplied data without proper checks. Attackers can exploit this by submitting a zero-byte file during registration, which later deletes arbitrary files on the server when the account is activated. This can lead to remote code execution if critical files like wp-config.php are deleted.

Detection Guidance

Check for unauthorized file deletions in server logs, especially during user registration. Look for attempts to modify the 'field_N_hidden' parameter with file paths. Inspect WordPress plugin files for the BuddyPress XProfile Image Field plugin versions up to 3.1.0.

Impact Analysis

This vulnerability allows unauthenticated attackers to delete any file on the server if open registration and an image-type profile field are enabled. Deleting critical files like wp-config.php can lead to complete site compromise, data loss, or remote code execution. Attackers could also delete other sensitive files, disrupting services or exposing confidential information.

Compliance Impact

This vulnerability can severely impact compliance with GDPR and HIPAA by enabling unauthorized file deletion. GDPR requires protecting personal data, and HIPAA mandates safeguarding health information. If attackers delete logs or databases, organizations may fail to meet audit or breach notification requirements, leading to legal penalties and reputational damage.

Mitigation Strategies
  • Update the BuddyPress XProfile Image Field plugin to the latest version immediately.
  • Disable open registration on your WordPress site if not required.
  • Review server logs for signs of exploitation or file deletions.
  • Remove the vulnerable plugin if an update is not available.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-120518. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...