CVE-2026-120518

Name of the Vulnerable Software and Affected Versions BuddyPress XProfile Image Field versions prior to 3.1.1

Description Unauthenticated attackers can delete arbitrary files on the server by submitting a zero-byte file via the field N hidden parameter during the registration process. This occurs because the bpxp image field update on user activation() function calls unlink() on a path constructed from visitor-supplied signup metadata without using realpath() resolution, containment checks against the profile-image directory, or an extension allow-list. This issue requires open registration and an image-type profile field on the signup form. Deleting critical files, such as wp-config.php, can lead to remote code execution.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.