BuddyPress XProfile Image Field: arbitrary file deletion (CVE-2026-120518)
A vulnerability, CVE-2026-120518 (CVSS 9.1), was published in the BuddyPress XProfile Image Field plugin for WordPress. The user activation function calls unlink() on a path built from signup data with no validation. Unauthenticated attackers can delete arbitrary files on the server.
Checked in Shield: no
Who is affected
All plugin versions up to and including 3.1.0. Conditions: open registration and an image-type profile field on the signup form.
How to check
In the WordPress admin, check whether the plugin is installed and which version it is. Confirm whether open registration is enabled and whether the signup form has an image-type field.
How to fix
The source does not state a patch status. Since exploitation requires open registration and an image field, until a fix is available consider disabling the plugin, closing registration, or removing that field from the form.
What Shield checks not checked
Checked in Shield: no. This is usually not visible from outside, or the check has not been added yet; we collect such cases and add checks in batches.
Good to know
The fixed version and any exploitation in the wild are not disclosed yet; source: NVD entry.
