Arbitrary File Deletion in BuddyPress Xprofile Custom Field Types Plugin for WordPress

CVE-2025-14997

What is CVE-2025-14997?

The BuddyPress Xprofile Custom Field Types plugin for WordPress contains a security flaw that allows authenticated users with at least Subscriber privileges to exploit insufficient path validation in the 'delete_field' function. This vulnerability can be leveraged to delete arbitrary files from the server. If critical files such as wp-config.php are removed, it can lead to severe consequences including potential remote code execution, compromising the entire web application.

References