This vulnerability allows an attacker to delete arbitrary files from the web server through a path-traversal flaw in the BuddyPress XProfile Custom Image Field plugin. The flaw occurs when the plugin processes a custom image field request and does not properly restrict the pathname, enabling users to specify a directory outside the intended upload folder. A successful exploit would result in loss of data or configuration files which could affect site functionality or integrity of the file system.

The flaw affects the BuddyPress XProfile Custom Image Field plugin by Alex Githatu. Versions from unknown earlier releases up to and including 3.0.1 are impacted. Users running any of these affected releases on a WordPress installation should be aware that the vulnerability exists.

The CVSS score of 8.6 classifies the issue as high severity, and the EPSS score of less than 1 % indicates a very low likelihood that an exploit is currently observed in the wild. The vulnerability is not listed in CISA’s KEV catalog. Based on the description, it is inferred that an attacker would typically need access to the WordPress administrative interface or a way to submit a crafted request to the plugin; once this mechanism is activated, directory traversal can be used to target arbitrary files on the server.