# CVE-2026-120518: BuddyPress XProfile Image Field arbitrary file deletion

Source: https://junglewise.ai/threats/cve-2026-120518-the-buddypress-xprofile-image-field-plugin-for-wordpress-is  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-03. Updated: 2026-11-03  
License: CC BY 4.0 with a link back

CVE-2026-120518 · Severity: critical · CVSS 9.1 · Published 2026-11-03

The BuddyPress XProfile Image Field plugin for WordPress allows unauthenticated attackers to delete arbitrary files on a website's server by exploiting improper path validation during user registration. Deleting critical files like wp-config.php can result in complete site takeover or remote code execution. The vulnerability requires that the website has open registration enabled and an image-type profile field on the signup form.

Vendors: [BuddyPress](https://junglewise.ai/threats/vendors/buddypress).

## Quick answers

**Is CVE-2026-120518 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-120518 being exploited in the wild.

**How severe is CVE-2026-120518?** Critical severity, with a CVSS score of 9.1, published 3 November 2026.

**Which products and versions are affected?** BuddyPress XProfile Image Field up to and including 3.1.0.

**Is there a fix for CVE-2026-120518?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-120518 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-120518?** Check whether you run BuddyPress XProfile Image Field at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The plugin's bpxp_image_field_update_on_user_activation() function calls unlink() on a path constructed from user-supplied signup metadata (the 'field_N_hidden' parameter) without realpath() resolution, directory containment checks, or file-type validation. An unauthenticated attacker can submit a zero-byte file during registration; when the pending signup is activated, this malicious path is resolved against the document root, enabling arbitrary file deletion and potential RCE.

## Affected products

- BuddyPress XProfile Image Field up to and including 3.1.0

## Timeline

- 2026-11-03: disclosed

## References

- [https://plugins.trac.wordpress.org/browser/buddypress-xprofile-image-field/tags/3.1.0/bp-xprofile-image-field.php](https://plugins.trac.wordpress.org/browser/buddypress-xprofile-image-field/tags/3.1.0/bp-xprofile-image-field.php)