CVE-2026-120518 in BuddyPress XProfile Custom Image Field Plugin
Summary
by MITRE • 11/03/2026
The BuddyPress XProfile Image Field plugin for WordPress is vulnerable to arbitrary file deletion in all versions up to, and including, 3.1.0. This is due to bpxp_image_field_update_on_user_activation() calling unlink() on a path built from visitor-supplied signup metadata with no realpath() resolution, no containment check against the profile-image directory and no extension allow-list. Submitting a zero-byte file with the 'field_N_hidden' parameter during registration makes the plugin store the raw value, which is then resolved against the document root when the pending signup is activated. This makes it possible for unauthenticated attackers to delete arbitrary files on the server, which can easily lead to remote code execution when the right file (such as wp-config.php) is deleted. Requires open registration and an image-type profile field on the signup form.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 11/03/2026
The BuddyPress XProfile Image Field plugin for WordPress contains a critical vulnerability affecting all versions up to 3.1.0, classified under CWE-22: Improper Limitation of a Pathname to a Restricted Directory and CWE-78: OS Command Injection via indirect means through file system operations. This flaw stems from the function bpxp_image_field_update_on_user_activation(), which processes user signup metadata during account activation without implementing adequate security controls. Specifically, the plugin constructs a file path using raw input supplied by visitors during registration and passes this unvalidated path directly to the PHP unlink() function for deletion purposes. The absence of realpath() resolution means that symbolic links or relative paths are not normalized against the expected directory structure, allowing attackers to traverse outside the intended scope. Furthermore, there is no containment check ensuring the target file resides within the designated profile-image directory, nor is there an extension allow-list to restrict operations to specific image formats.
The exploitation mechanism relies on open registration settings and the presence of an image-type profile field in the signup form. An unauthenticated attacker can submit a zero-byte file during the initial registration process while setting the 'field_N_hidden' parameter appropriately. This action causes the plugin to store the raw, unsanitized value associated with that field rather than processing it as a standard uploaded asset. When the pending user account is subsequently activated by an administrator or automatically via system processes, the vulnerable function executes and attempts to delete the file specified in the stored metadata. Because this path was never validated against server-side constraints, attackers can manipulate it to reference arbitrary files on the web server's filesystem.
The operational impact of this vulnerability extends far beyond simple data loss. By deleting critical configuration or core WordPress files such as wp-config.php, an attacker can disrupt service availability and potentially facilitate remote code execution. For instance, removing wp-config.php may force the application into a fallback state that exposes sensitive database credentials in error logs or allows for re-initialization with malicious parameters if not properly secured. Additionally, deleting other server-side scripts could lead to privilege escalation or complete compromise of the underlying infrastructure depending on file permissions and hosting environment configurations. This aligns with MITRE ATT&CK technique T1485: Data Destruction, where adversaries aim to disrupt availability by destroying data stored in information systems.
Mitigation strategies must address both immediate remediation and long-term defensive posture changes. The most effective solution is to upgrade the BuddyPress XProfile Image Field plugin to a version that patches this vulnerability, ensuring that developers have implemented proper input validation, path canonicalization using realpath(), strict directory containment checks, and extension whitelisting before performing any file system operations. In environments where immediate patching is not feasible, administrators should disable open registration until the update can be applied, thereby preventing unauthenticated users from triggering the vulnerable code path during signup activation. Additionally, implementing Web Application Firewall rules that detect attempts to access or manipulate sensitive files like wp-config.php through unusual parameter patterns may provide an additional layer of defense against exploitation attempts.