CVE-2025-14997

Name of the Vulnerable Software and Affected Versions BuddyPress Xprofile Custom Field Types plugin versions through 1.2.8

Description The BuddyPress Xprofile Custom Field Types plugin for WordPress has a flaw that allows authenticated attackers with Subscriber-level access or higher to delete arbitrary files on the server. This is due to inadequate file path validation within the delete field function. Deleting specific files, such as wp-config.php, could lead to remote code execution.

Recommendations Update BuddyPress Xprofile Custom Field Types plugin to a version later than 1.2.8.