BuddyPress Xprofile Custom Fields Type 2.6.3 contains an arbitrary file deletion vulnerability that allows authenticated users to delete files by manipulating unescaped POST parameters. Attackers can alter the field_hiddenfile and field_deleteimg parameters during profile editing to unlink files from the server. This flaw is an example of insecure direct object reference (CWE‑22) and gives an attacker the ability to remove any file that the application’s process user can delete, potentially compromising critical application files and leading to further compromise or denial of service.

The vulnerability impacts the BuddyPress Xprofile Custom Fields Type plugin, version 2.6.3, sold by donmik and deployed on WordPress sites that use the BuddyPress Xprofile extension. No other vendor or product versions are listed in the CNA data, and the flaw appears to be confined to this specific release.

The CVSS score of 8.7 classifies this as a high‑severity issue. The EPSS score of 0.00741 (under 1%) indicates a very low but nonzero probability of exploitation, and the vulnerability is not currently listed in the CISA KEV catalog. Attackers must be authenticated and possess permissions to edit profile fields, which implies a local or privileged user rather than an anonymous remote attacker. The exploit requires sending a crafted POST request to the profile edit endpoint, so mitigating the vulnerability involves both removing the logic that accepts unvalidated input and restricting the range of users who can perform the edit.