CVE-2026-120518 | CVSS: 9.1 | 严重级别: CRITICAL
The BuddyPress XProfile Image Field plugin for WordPress is vulnerable to arbitrary file deletion in all versions up to, and including, 3.1.0. This is due to bpxp_image_field_update_on_user_activation() calling unlink() on a path built from visitor-supplied signup metadata with no realpath() resolution, no containment check against the profile-image directory and no extension allow-list. Submitting a zero-byte file with the 'field_N_hidden' parameter during registration makes the plugin store the raw value, which is then resolved against the document root when the pending signup is activated.
参考链接:
• https://nvd.nist.gov/vuln/detail/CVE-2025-48158
• https://plugins.trac.wordpress.org/browser/buddypress-xprofile-image-field/tags/
• https://plugins.trac.wordpress.org/browser/buddypress-xprofile-image-field/tags/
📌 数据来源: NVD 官方