CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
What the vulnerability does
The BuddyPress Xprofile Custom Field Types plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the 'delete_field' function in all versions up to, and including, 1.2.8. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php).
Explanation of Vulnerability in Simple Terms
BuddyPress Xprofile Custom Field Types versions 1.2.8 and earlier contain a path traversal vulnerability that allows authenticated users to read, modify, or delete arbitrary files on the server. An attacker with a low-privilege account can exploit this without user interaction to access sensitive data, alter site files, or disrupt availability.
What an attacker can do
Read, modify, or delete arbitrary files on the server with the web server's permissions.
Potential impact on your site
Any authenticated user can access sensitive files, alter site configuration, or cause service disruption.
Conditions required to exploit
Attacker must have a low-privilege user account on the site; no user interaction required.
Key dates
External resources
