CVE-2026-120518— BuddyPress XProfile Image Field <= 3.1.0 - Unauthenticated Arbitrary File Deletion via Signup Image Field Activation Handler

Quick assessment

Affected

kalengi BuddyPress XProfile Custom Image Field

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

WordPress 的 BuddyPress XProfile Image Field 插件在所有 3.1.0 及更早版本中存在任意文件删除漏洞。该漏洞源于函数在调用时，直接使用访客提供的注册元数据构建文件路径，却未执行以下关键安全措施：未进行路径解析、未将路径限制在个人资料图片目录内、也未实施文件扩展名白名单校验。攻击者可在注册过程中提交一个零字节文件，并设置参数，使插件将原始参数值直接存储。当待处理的注册账号被激活时，该路径会相对于文档根目录进行解析，从而导致未认证攻击者能够删除服务器上的任意文件。若

CVSS 9.1 · Critical Updated Nov 03, 2026

Possible ATT&CK Techniques 2 AI

T1565 · Data Manipulation T1190 · Exploit Public-Facing Application

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

BuddyPress XProfile Image Field <= 3.1.0 - Unauthenticated Arbitrary File Deletion via Signup Image Field Activation Handler

Source: CVE Program / CVE List V5

Vulnerability Description

The BuddyPress XProfile Image Field plugin for WordPress is vulnerable to arbitrary file deletion in all versions up to, and including, 3.1.0. This is due to bpxp_image_field_update_on_user_activation() calling unlink() on a path built from visitor-supplied signup metadata with no realpath() resolution, no containment check against the profile-image directory and no extension allow-list. Submitting a zero-byte file with the 'field_N_hidden' parameter during registration makes the plugin store the raw value, which is then resolved against the document root when the pending signup is activated. This makes it possible for unauthenticated attackers to delete arbitrary files on the server, which can easily lead to remote code execution when the right file (such as wp-config.php) is deleted. Requires open registration and an image-type profile field on the signup form.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

Source: CVE Program / CVE List V5

Vulnerability Type

对路径名的限制不恰当(路径遍历)

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
kalengi	BuddyPress XProfile Custom Image Field	0 ~ 3.1.0	-

II. Public POCs for CVE-2026-120518

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-120518

请登录查看更多情报信息。

Other References for CVE-2026-120518 (7)

https://www.cve.org/CVERecord?id=CVE-2026-120518

IV. Related Vulnerabilities

Same product: BuddyPress XProfile Custom Image Field

CVE-2025-48158
WordPress BuddyPress XProfile Custom Image Field Plugin <= 3

Same weakness: CWE-22