XProfile Image Field EUVD-2026-115659

Exploitation requires two non-default deployment conditions stated in the description: (1) open/public user registration must be enabled, and (2) the BuddyPress signup form must include an image-type XProfile field whose 'field_N_hidden' parameter the attacker controls. Given those, no authentication is required (PR:N) and no user interaction is needed, but activation of the pending signup must occur for bpxp_image_field_update_on_user_activation() to invoke unlink(). Limiting factors: sites with registration disabled, or without an image-type XProfile field on signup, are not exploitable; impact depends on filesystem permissions of the web-server user over the targeted path (e.g. wp-config.php) for the deletion to succeed and escalate.

Multiple signals converge on genuine high priority. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) describes network-reachable, unauthenticated, low-complexity exploitation with high integrity and availability impact (C:N/I:H/A:H, base 9.1), and the vuln.today decision label is act_now, reported by Wordfence. The mechanism is credible: unlink() on a document-root-resolved path from visitor-supplied 'field_N_hidden' signup metadata, with no realpath()/containment/extension checks, yielding arbitrary file deletion that escalates to RCE when wp-config.php is removed. The key tempering factor is configuration dependence: exploitation requires open user registration AND an image-type XProfile field on the signup form, neither of which is a WordPress default - this narrows the exploitable population well below the raw CVSS footprint. No EPSS score is provided and the CVE is not in CISA KEV, so there is no quantitative exploitation-probability or confirmed-in-the-wild signal; no public exploit is identified in the input (the references are the Wordfence advisory and plugin source lines, not a working PoC). Net: a real, patch-now-class issue on affected deployments, but the config prerequisites mean impact is conditional rather than universal. Note also a cross-reference anomaly - the NVD reference points to CVE-2025-48158, a different identifier - which should be verified with the vendor/NVD.

On a site with open registration and an image-type XProfile field, an unauthenticated attacker fills the registration form and submits a crafted 'field_N_hidden' value pointing at a traversal path (e.g. to wp-config.php) along with a zero-byte file; the raw value is stored with the pending signup. When that signup is activated, bpxp_image_field_update_on_user_activation() resolves the path against the document root and calls unlink(), deleting the targeted server file. Deleting wp-config.php can cascade into site takeover/RCE. No public working exploit is identified at time of analysis.