#NØØT_Security_Alerts 🚨 #ALERT — BuddyPress XProfile Image Field Vulnerability Enables Unauthenticated Arbitrary File Deletion November 3, 2026 PRODUCT: BuddyPress XProfile Custom Image Field, a WordPress plugin—not BuddyPress core. CVE: CVE-2026-120518 | CRITICAL (CVSS 3.1: 9.1, Wordfence CNA). AFFECTED: All versions through 3.1.0. No fixed version is established by the opened primary sources. http://WordPress.org lists 3.1.0 and states that the plugin has been closed to downloads since October 5, pending review. PREREQUISITES: Open user registration with an image-type XProfile field on the signup form. Crafted signup metadata can reach an unchecked file-deletion operation when a pending signup is activated. IMPACT: The bpxp_image_field_update_on_user_activation() function passes an attacker-influenced path to unlink() without sufficient path containment. Files writable by the PHP process, potentially including wp-config.php, can be deleted. Deleting the configuration file can create conditions for subsequent site compromise or code execution. RCE is NOT demonstrated as an automatic consequence. MATERIAL CHANGE: Wordfence’s official CNA record was published November 3, following a recorded October 13 disclosure. An earlier, separately assigned Patchstack vulnerability, CVE-2025-48158, was marked fixed in 3.1.0. That earlier fix does not establish protection against this newly recorded activation-handler flaw. EXPLOITATION STATUS: Vulnerability documented by the responsible CNA. No malicious real-world exploitation or victim compromise was established by the accessible primary evidence. TRIAGE: Inventory installations and registration configurations. Review suspicious signup metadata, account-activation events, file integrity and unexplained configuration-file deletion. Examine subsequent installer access or unauthorized administrative changes. Individual indicators are investigative leads, not proof of successful exploitation; missing logs do not establish safety. URGENT ACTION: Disable the vulnerable plugin and suspend affected image-field registration flows until a verified fix exists, coordinating any impact on legitimate registrations and profiles. Preserve relevant logs and file evidence. Verify configuration integrity and investigate unauthorized changes. If wp-config.php is missing or altered, restrict public setup access, restore from a trusted backup and assess potential compromise before reopening the site. Rotate credentials where exposure or unauthorized access warrants it. Do not treat reinstalling the same vulnerable version as remediation. SOURCE — WORDFENCE OFFICIAL CNA RECORD: https://github.com/CVEProject/cvelistV5/blob/main/cves/2026/120xxx/CVE-2026-120518.json SOURCE — WORDPRESS PLUGIN STATUS: https://wordpress.org/plugins/buddypress-xprofile-image-field/ SOURCE — EARLIER PATCHSTACK CNA RECORD: https://github.com/CVEProject/cvelistV5/blob/main/cves/2025/48xxx/CVE-2025-48158.json CONFIDENCE: HIGH for registered vulnerability identity, affected versions, technical mechanism and current directory status. LIMITED for actual exploitation, conditional RCE consequences and any future patched release. #CyberSecurity #InfoSec #WordPress #AppSec #CVE #WebSecurity #VulnerabilityManagement #IncidentResponse