The BuddyPress Xprofile Custom Field Types plugin contains a flaw in the delete_field function that does not properly validate the file path. An attacker who can log in with any role of Subscriber or higher can supply an arbitrary path and trigger deletion. Removing critical files such as wp-config.php can give the attacker a foothold for remote code execution, or lead to site compromise. The vulnerability arises from insufficient path validation, classified as a path traversal defect.

This issue affects every installation of BuddyPress Xprofile Custom Field Types up to and including version 1.2.8. The plugin is a WordPress add‑on, so any WordPress site using those versions is impacted. No other products are referenced.

The CVSS score of 8.8 indicates high severity; the EPSS score of less than 1% means current exploitation probability is low, and the vulnerability is not listed in CISA’s KEV catalog. The attacker must be authenticated and have at least Subscriber permissions, which is commonly granted to many users on a site. Once authenticated, the attacker can send a request to the plugin’s delete endpoint with a crafted file path and cause deletion of any file the web server process can write to.