BuddyPress XProfile Image Field Plugin Arbitrary File Deletion Vulnerability

The BuddyPress XProfile Image Field plugin for WordPress is vulnerable to arbitrary file deletion in all versions up to and including 3.1.0.

The vulnerability occurs because bpxp_image_field_update_on_user_activation() calls unlink() on a path built from visitor-supplied signup metadata. There is no realpath() resolution, no containment check against the profile-image directory, and no extension allow-list.

Submitting a zero-byte file with the field_N_hidden parameter during registration causes the plugin to store the raw value, which is later resolved against the document root when the pending signup is activated. This allows unauthenticated attackers to delete arbitrary files, potentially leading to remote code execution if a critical file such as wp-config.php is removed.

• Affected versions: up to and including 3.1.0
• Preconditions: open registration and an image-type profile field on the signup form
• Impact: arbitrary file deletion, which can lead to remote code execution