On this page (7 sections)
A critical vulnerability, CVE-2026-120518, affects the BuddyPress XProfile Image Field plugin for WordPress in all versions up to and including 3.1.0. According to the NVD record, an unauthenticated visitor can cause the plugin to delete arbitrary files on the server during the account activation process.
If you run a WordPress site with BuddyPress, open user registration and a profile image field on the signup form, you should check this plugin now. Deleting a file such as wp-config.php can lead to a full site takeover.
What happened
The vulnerability was published on 2026-11-03. The NVD description says the plugin function bpxp_image_field_update_on_user_activation() calls unlink() on a file path that is built from data a visitor supplies during signup. The code does not resolve the path with realpath(), does not check that the path stays inside the profile-image directory, and does not restrict file extensions.
Only one independent publisher covers this story so far, and the details here come from the NVD record. We have not seen a vendor advisory or a patched release number, so treat anything beyond the record as unconfirmed.
How the weakness works
This is a path traversal weakness (CWE-22) that ends in file deletion rather than file reading. Plugins that accept file-related input should confirm that the final path points inside an intended folder before touching it. Here, the NVD record describes that check as missing.
Per the record, the flow looks like this: during registration, a visitor submits a zero-byte file together with the field_N_hidden parameter, and the plugin stores the raw value of that parameter. Later, when the pending signup is activated, the stored value is resolved against the document root and the file at that location is deleted. We are deliberately not describing exact request contents.
Why deletion is serious: the record notes it can easily lead to remote code execution when the right file, such as wp-config.php, is deleted. In general terms, a WordPress site missing its configuration file can fall back to the installation screen, which is a well-known route to takeover. The record itself only states that code execution can follow.
Who is affected
The NVD record states two preconditions: the site must allow open registration, and the signup form must include an image-type profile field. Sites that meet both conditions and run version 3.1.0 or earlier are exposed to unauthenticated attackers, with no account needed.
- Community, membership and directory sites built on BuddyPress with public signup
- Agencies managing client sites that use XProfile image fields on registration
- Sites where the plugin is installed but inactive: confirm it is removed or updated, since the record speaks only of installed versions
Sites with registration closed, or without an image-type field on the signup form, do not meet the conditions described in the record. Do not rely on that alone, since configuration can change and the plugin should still be dealt with.
How to check your exposure
First, find out whether the plugin is installed and which version you run. This WP-CLI command lists matching plugins with their status and version. Run it from your WordPress root and look for buddypress-xprofile-image-field with a version of 3.1.0 or lower.
wp plugin list --fields=name,status,version | grep -i xprofileNext, check whether registration is open. This command prints the setting; a value of 1 means anyone can register on a standard WordPress setup. BuddyPress also has its own registration setting under Settings, BuddyPress, Options in the admin area, so check there too.
wp option get users_can_registerFinally, open the BuddyPress profile field settings in the admin area and see whether any image-type field is shown on the signup form.
What to do now
We could not confirm a patched version from the research, so check the plugin's page in the WordPress plugin directory and the Wordfence entry for the current fix status before relying on an update.
0 of 8 done
If you cannot update, a website firewall may help reduce risk, but rules for this specific issue are not something we can promise. Removing the exposed feature is the dependable option.
Detection and monitoring
Signs of abuse would include missing files, a site suddenly showing the WordPress setup screen, or unexpected errors after new users activate accounts. This command searches an access log for requests to the BuddyPress registration and activation pages. Run it on the server, adjust the log path for your setup, and look for bursts of requests from a single address.
grep -iE 'register|activate' /var/log/nginx/access.log | tail -n 100A file integrity check against a known-good copy of WordPress core can reveal removed files. After any suspected incident, follow our guide on what to do when a website is hacked, and use the free malware scanner for an outside-in look at the site. Note that outside scans cannot see everything on the server, as explained in what outside-in malware detection can and cannot see.
For ongoing awareness of plugin issues, the known WordPress plugin vulnerabilities page and our WordPress security checklist are good places to start.
Timeline
| Date | Event |
|---|---|
| 2026-11-03 | CVE-2026-120518 published in NVD, CVSS 9.1, affecting versions up to and including 3.1.0 |
| 2026-11-03 | No fixed version or exploitation reports found in the available research |
Sources
This article is based on the public sources below. Details can change as vendors and researchers publish more; check the original advisories before acting on version numbers.