Arbitrary File Deletion Vulnerability in BuddyPress XProfile Image Field Plugin

CVE-2026-120518

What is CVE-2026-120518?

The BuddyPress XProfile Image Field plugin for WordPress is exposed to a vulnerability that allows for arbitrary file deletion across all versions up to 3.1.0. This issue exists due to the function bpxp_image_field_update_on_user_activation() improperly handling user-supplied data, particularly in relation to file paths. By submitting a zero-byte file with a specific parameter during user registration, an unauthorized attacker can manipulate the system to delete files on the server, potentially including sensitive files such as wp-config.php. The vulnerability requires open registration settings and an image-type profile field present on the signup form, which makes exploitation feasible.

References