A critical path traversal flaw (CVSS 9.1) in a WordPress BuddyPress profile-image plugin lets unauthenticated attackers delete arbitrary files writable by the web server process. Deleting the right file, such as wp-config.php, can lead to remote code execution.
What Is It
CVE-2026-120518 is an arbitrary file deletion vulnerability, classified as CWE-22 (Path Traversal), in the BuddyPress XProfile Image Field plugin for WordPress. The bug is in the bpxp_image_field_update_on_user_activation() function. It calls unlink() on a file path built from signup metadata supplied by the visitor. The function never resolves the path with realpath(), never checks that the path stays inside the profile-image directory, and has no allow-list of file extensions.
An attacker registers an account, uploads a zero-byte file, and sets the field_N_hidden parameter to a path of their choice. The plugin stores that raw value. When the pending signup is activated, the plugin resolves the value against the document root and deletes the target file.
Wordfence reported the vulnerability. NVD published it on November 3, 2026, and its NVD status is currently "Deferred."
Why It Matters
- No authentication or user interaction needed: the CVSS vector is
AV:N/AC:L/PR:N/UI:N, so an anonymous attacker can exploit it over the network with little effort. - Path to code execution: Wordfence notes that deleting a file like wp-config.php "can easily lead to remote code execution." A WordPress site without wp-config.php drops back into its setup routine.
- High impact: integrity and availability are both rated HIGH. Confidentiality impact is rated NONE.
Exploitation status: none of the sources cited below report active exploitation of CVE-2026-120518 in the wild.
Preconditions: exploitation only works when the site allows open registration and the signup form includes an image-type profile field.
What's Vulnerable
- Vendor: kalengi
- Product: BuddyPress XProfile Custom Image Field (the NVD description calls it "BuddyPress XProfile Image Field")
- Affected versions: all versions up to and including 3.1.0
The supplied data does not list any affected CPEs.
Patch Status
The source material does not name a fixed version or official patch. Until the vendor confirms a fix, administrators running version 3.1.0 or earlier should check the Wordfence advisory for updates. The two exploitation preconditions also point to interim options: turn off open registration, or remove image-type profile fields from the signup form.