BuddyPress XProfile Custom Image Field Path Traversal Vulnerability Allowing Arbitrary File Deletion

A path traversal vulnerability has been identified in the BuddyPress XProfile Custom Image Field plugin, versions through 3.0.1. This vulnerability allows for improper limitation of a pathname to a restricted directory, potentially leading to arbitrary file deletion on the affected WordPress site.

Impact

Exploitation of this vulnerability could result in the deletion of arbitrary files from the WordPress site, including core files, which could disrupt the site's functionality.

Remediation

Users of the BuddyPress XProfile Custom Image Field plugin should update to version 3.1.0 or later. Patchstack users can enable auto-updates for vulnerable plugins.