Buddypress Xprofile Custom Image Field
Monthly
Unauthenticated arbitrary file deletion in the BuddyPress XProfile Image Field plugin through 3.1.0 allows remote attackers to remove server files, including wp-config.php, when web-server filesystem permissions permit the deletion, potentially leading to remote code execution. The vulnerable path is built from visitor-supplied signup metadata and passed to unlink() without realpath() resolution or containment checks; exploitation requires open registration and an image-type XProfile field on the signup form. No public exploit is identified in the available data, and the vuln.today decision label is act_now.
Unauthenticated arbitrary file deletion in the BuddyPress XProfile Image Field plugin through 3.1.0 allows remote attackers to remove server files, including wp-config.php, when web-server filesystem permissions permit the deletion, potentially leading to remote code execution. The vulnerable path is built from visitor-supplied signup metadata and passed to unlink() without realpath() resolution or containment checks; exploitation requires open registration and an image-type XProfile field on the signup form. No public exploit is identified in the available data, and the vuln.today decision label is act_now.