Executive Summary
CVE-2026-120518 is a critical (CVSS 3.1: 9.1, AV:N/AC:L/PR:N/UI:N) arbitrary file deletion vulnerability in the BuddyPress XProfile Image Field plugin for WordPress. All versions up to and including 3.1.0 are affected. The CVE was published on November 3, 2026.
Vulnerability Details
The function bpxp_image_field_update_on_user_activation() calls unlink() on a path built from visitor-supplied signup metadata. The code performs no realpath() resolution, no containment check against the profile-image directory, and no extension allow-list (CWE-22, path traversal).
An unauthenticated visitor can therefore influence which file the server deletes during account activation.
Preconditions:
- Open user registration is enabled
- An image-type profile field is present on the signup form
Impact
Arbitrary file deletion in WordPress is commonly escalated to full site takeover. Deleting wp-config.php, for example, can force the site back into the installation flow, letting an attacker connect it to a database they control and gain code execution. Other outcomes include deleting security plugin files or .htaccess rules and causing denial of service.
Status
- No fixed version is listed in the available advisories
- Not listed in CISA KEV; no confirmed in-the-wild exploitation was found. Some threat-intel feeds report scanning activity, but sources conflict
- NVD analysis status is currently deferred
Remediation
- Check whether the plugin is installed:
wp plugin list | grep xprofile - If a patched release above 3.1.0 is available, update immediately
- Otherwise deactivate and remove the plugin, or disable open registration and remove image-type fields from the signup form
- Ensure file permissions prevent the web server user from writing to
wp-config.phpand core files where feasible - Keep verified backups and review web logs for registration requests with path-traversal sequences such as
../