Critical vulnerability
Critical arbitrary file access in the BuddyPress XProfile Image Field WordPress plugin (CVE-2026-120518)
Arbitrary file access in BuddyPress XProfile Image Field · WordPress plugins
CVE-2026-120518
BuddyPress XProfile Image Field <= 3.1.0 - Unauthenticated Arbitrary File Deletion via Signup Image Field Activation Handler
- Severity
- Critical 9.1
- Published
- 3 Nov 2026
| Software | Affected versions |
|---|---|
| Buddypress Xprofile Image Field (WordPress plugin)WordPress plugins |
|
- CVE.org https://www.cve.org/CVERecord?id=CVE-2026-120518
From NVD, the CVE Program, OSV.dev with the GitHub Advisory Database, WPVulnerability, WordPress's security advisories and CISA's Known Exploited Vulnerabilities catalog, as they stood when this was written. Each vulnerability's own page has its latest rating and fix. This product uses the NVD API but is not endorsed or certified by the NVD.