BuddyPress XProfile Image Field: critical flaw in all versions up to 3.1.0

What it is and who is affectedThe BuddyPress XProfile Image Field plugin for WordPress carries a critical vulnerability tracked as CVE-2026-120518, pu...

What it is and who is affected

The BuddyPress XProfile Image Field plugin for WordPress carries a critical vulnerability tracked as CVE-2026-120518, published in the NIST National Vulnerability Database on 3 November 2026. The flaw is an arbitrary file deletion issue (CWE-22, path traversal) and affects all versions up to and including 3.1.0.

According to the NVD description, the problem sits in the bpxp_image_field_update_on_user_activation() function, which calls unlink() on a path built from visitor-supplied signup metadata. There is no realpath() resolution, no containment check against the profile-image directory and no extension allow-list. By submitting a zero-byte file through the field_N_hidden parameter during registration, an attacker can make the plugin store the raw value, which is later resolved against the document root when the pending signup is activated.

The result is that unauthenticated attackers can delete arbitrary files on the server. The CVSS 3.1 score is 9.1 (CRITICAL), with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H. Two conditions must be met for exploitation: open registration must be enabled and an image-type profile field must exist on the signup form. That combination is common on community sites, membership portals and BuddyPress-based platforms run by SMEs and small IT teams across Spain and Catalonia.

Why it matters: the path to remote code execution

Deleting a file may sound less alarming than data theft, but in WordPress the consequences escalate quickly. If the right file is removed — the NVD explicitly names wp-config.php as an example — the site can be pushed towards a reinstallation flow or left in an inconsistent state that opens the door to remote code execution. In practice, a single unauthenticated request chain can turn a functioning shop or member portal into an exposed installation.

It is important to be precise about the current threat picture: at the time of writing, CVE-2026-120518 does not appear in CISA's Known Exploited Vulnerabilities (KEV) catalogue, so there is no public confirmation that it is being exploited in real attacks. That is not a reason to wait. The attack requires no credentials and no user interaction, the exploit surface is a public registration form, and the flaw has been public since its NVD publication. For a PrestaShop, Joomla or WordPress estate managed by a small team, unpatched community plugins are one of the most frequent entry points we see.

What to do today

Check whether the plugin is installed. Look in the WordPress plugin list of every site you run, including staging copies and forgotten multisite installations. Confirm the exact version; anything at or below 3.1.0 is in scope.
Apply the fix indicated by the vendor's advisory. The NVD entry does not state a corrected version, so follow the plugin author's official notice for the version to install. If no fixed release is available yet, consider deactivating the plugin until one appears.
Reduce exposure in the meantime. If the plugin must stay active, review whether open registration is genuinely needed and whether an image-type profile field has to be present on the signup form. Both conditions are required for the attack, so removing either one narrows the window considerably.
Look for signs of intrusion. Check web server logs for registration requests carrying suspicious field_N_hidden values, and verify that core files such as wp-config.php are present and intact. Compare file integrity against a known-good backup.
Treat missing files as an incident. If you find deleted or altered files, restore from a clean backup, rotate database and salts credentials, and review administrator accounts before reopening registration.

As always, keep WordPress core, themes and plugins under a regular update routine. Most critical plugin flaws are only dangerous while the update is pending, and the gap between publication and patching is exactly where small teams get caught.

How a cybersecurity team like ALMC's can help

Keeping track of which plugin version runs on which site — and which of them accepts public registrations — is tedious work for a small IT department. At ALMC we approach this from the infrastructure side: security audits and pentesting to map what is actually exposed, hardening of servers and CMS installations, and monitoring with incident response when something looks wrong. We also handle maintenance and updates for WordPress, PrestaShop and Joomla, and repair websites that have already been compromised.

For a business in Lleida, Barcelona, Tarragona or Girona running its own servers or a lean IT team, the practical value is simple: vulnerabilities get closed before someone finds them, and when a critical CVE like this one lands, there is a defined process — inventory, patch, verify, monitor — instead of a scramble. All of it aligned with GDPR obligations around the security of personal data processed on your website.

Is your business exposed to flaws like this?

ALMC checks which versions you are running, applies the patches and hardens your servers and website. Contact our team for a security review.

Results without leaving the page.