BuddyPress XProfile Image Field <= 3.1.0 - Unauthenticated Arbitrary File Deletion via Signup Image Field Activation Handler
CVSS score
9.1
EPSS probability
—
Risk score
0.9
Published
2 h ago
Resmî kaynaklarda yeterli kanıt bulunamadı. Bu sonuç “yama yok” anlamına gelmez.
Impact on My Inventory
Only the personal products you have added to your account are assessed; an organisation's inventory does not appear here.
Checking session…
Vulnerability description
DayBreach AI Explanation
Verified against sourcesSources read
2
Source agreement
Tam uyum
Evidence confidence
%61
Short explanation
In BuddyPress XProfile Image Field versions up to 3.1.0, an attacker can upload a zero‑byte file with the 'field_N_hidden' parameter during registration; the bpxp_image_field_update_on_user_activation() function calls unlink() on the supplied path without realpath resolution, containment checks, or an extension allow‑list. This enables unauthenticated deletion of arbitrary files, potentially leading to remote code execution when critical files such as wp-config.php are removed.
Critical (CVSS 9.1) flaw that can delete files and enable remote code execution, posing a high risk to WordPress sites.
What should be done?
- Apply the vendor advisory update when released
- Disable or restrict open registration
- Disable untrusted file uploads for profile fields
- Harden filesystem permissions
- Add path‑traversal checks via a WAF
- Remove the vulnerable plugin or replace it with a secure alternative
The sources give limited detail on some technical conditions. Review the chain of evidence below before deciding how to act.
Chain of evidence and sources
Bu açık, yetkisiz saldırganların kayıt sırasında gönderilen parametreyle sunucudaki rastgele dosyayı silmesine olanak tanır.
CVE, CISA KEV listesinde yer almıyor; aktif istismar teyit edilmemiştir.
Resmi kaynaklarda yama durumu doğrulanamadı; yama durumu UNKNOWN olarak rapor edilmiştir.
Show the technical text from the sources
The BuddyPress XProfile Image Field plugin for WordPress is vulnerable to arbitrary file deletion in all versions up to, and including, 3.1.0. This is due to bpxp_image_field_update_on_user_activation() calling unlink() on a path built from visitor-supplied signup metadata with no realpath() resolution, no containment check against the profile-image directory and no extension allow-list. Submitting a zero-byte file with the 'field_N_hidden' parameter during registration makes the plugin store the raw value, which is then resolved against the document root when the pending signup is activated. This makes it possible for unauthenticated attackers to delete arbitrary files on the server, which can easily lead to remote code execution when the right file (such as wp-config.php) is deleted. Requires open registration and an image-type profile field on the signup form.
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
CWE: CWE-22
This explanation was compiled automatically from the source records. Scores, active exploitation, patch and exploit status come straight from the sources.
IMPACT: Affected Products and Software
Affected Products
The following products are affected by CVE-2026-120518 vulnerability. Where our threat engine knows the exact affected versions, they are listed below.
| ID | VENDOR | PRODUCT | ACTION |
|---|---|---|---|
| 1 | kalengi | BuddyPress XProfile Custom Image Field | View |
RED HAT CSAF/VEX: Product Impact Check
SCORING: CVSS from Multiple Sources
CVSS Scores
The Common Vulnerability Scoring System is a standardised framework for assessing the severity of vulnerabilities in software and systems. We collect and display CVSS scores from several sources for each CVE.
| SCORE | VERSION | SEVERITY | VECTOR | SOURCE |
|---|---|---|---|---|
| 9.1 | CVSS V3_1 | CRITICAL | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H | CVE CNA |
| 9.1 | CVSS V31 | CRITICAL | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H | NVD |
Patch and Remediation Guide
Solution & Remediation Advisory
İncelenen resmî kaynaklarda yama durumu doğrulanamadı. Bu sonuç “yama yok” anlamına gelmez.
Public exploit and active exploitation status
Verified exploit intelligence
No verified public PoC, exploit repository or Metasploit module has been found for this CVE yet.
Weakness Classification and Attack Patterns (CWE & CAPEC)
CWE - Common Weakness Enumeration
While CVE identifies specific instances of vulnerabilities, CWE categorises the common flaws or weaknesses that can lead to vulnerabilities. CVE-2026-120518 is associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification (CAPEC) stores attack patterns, which are descriptions of the common attributes and approaches employed by adversaries to exploit the CVE-2026-120518 weaknesses.
Attack Vector and Accessibility
Official Sources and Advisories
Get this vulnerability through the API
Affected products, version ranges, exploitation status and patch information in a single request, with a free key.
curl -H "x-api-key: $DAYBREACH_API_KEY" \ "https://api.daybreach.dev/api/v1/intel/cves/CVE-2026-120518"