External risk intelligence

BuddyPress XProfile Image Field Arbitrary File Deletion Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.1)

CVE-2026-120518

The vulnerability exists in a WordPress plugin that modifies the user registration flow. Because it specifically requires open user registration to be enabled and an image field to be present on the public-facing signup form, it is commonly deployed in environments accessible to the internet. This creates a directly reachable, unauthenticated attack surface on the web server.

Path Traversal

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A security issue has been identified in a WordPress plugin that allows for arbitrary file deletion on the server. If your WordPress site allows new user registrations and includes an image upload field during signup, an attacker could potentially delete critical files, leading to significant disruption. The main concern is confirming whether this specific plugin and configuration are in use.

Plugin allows deleting any server file.
Critical if new users can register.
Confirm plugin use and configuration.

Attack Path

How an attacker could exploit the issue

An unauthenticated attacker can exploit this vulnerability by submitting a specially crafted zero-byte file during the user registration process. This file's metadata is processed insecurely by the BuddyPress XProfile Image Field plugin, allowing the attacker to trick the plugin into deleting arbitrary files on the server, potentially leading to remote code execution.

Open registration and an image field are required.
Crafting a zero-byte file during signup.
Arbitrary file deletion, enabling code execution.

Live Threat

Current exploitation, exposure, and threat context

When supported by the advisory's conditions of open registration and an image-type profile field, unauthenticated attackers could delete arbitrary files on the server. This could lead to remote code execution if critical files, such as configuration files, are deleted.

Arbitrary file deletion on server.
Unauthenticated deletion via crafted input.
Potential for remote code execution.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability impacts the BuddyPress XProfile Image Field plugin, making WordPress sites with open registration and image fields on their signup forms susceptible to arbitrary file deletion and potential remote code execution. Ownership likely falls to the application or platform team managing the WordPress instance, with the first step being to identify all affected sites, confirm their exposure via open registration and image fields, and assess business criticality.

Application owners should own this issue.
Verify open registration and image fields on signup.
Plan remediation based on site criticality and exposure.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the BuddyPress XProfile Image Field plugin?

It is an add-on for the BuddyPress suite in WordPress. It enables site administrators to include custom image upload fields on user registration forms, allowing new members to upload profile pictures during the signup process.

How does CVE-2026-120518 cause file deletion?

This vulnerability is an Improper Limitation of a Pathname, or Path Traversal (CWE-22). The plugin fails to validate user-supplied file paths during registration. By submitting specific data, an attacker can trick the system into deleting critical server files, as the code lacks checks to keep operations within a safe, intended directory.

When can an attacker trigger this vulnerability?

The attack requires two specific preconditions: open user registration must be enabled on the site, and the registration form must include an image-type profile field. If your site has registration disabled or does not use this specific plugin field type, the path for this exploit does not exist.

Is my site at risk according to Halo Surface Signal?

Halo Surface Signal identifies this as a 'Likely' threat because the plugin modifies public-facing signup forms. Since open registration is a common feature for community sites, this creates a directly reachable attack surface on the internet that does not require an attacker to have a user account.

What should I do if I use this plugin?

First, verify if your WordPress site allows open registrations and utilizes an image field in the signup flow. If these features are active, prioritize reviewing your configuration. Monitor the plugin developer's official channels for security updates and consider disabling registration or the plugin until you can apply a fix.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.