A critical path traversal vulnerability in the Buddypress Xprofile Custom Fields Type plugin for WordPress allows authenticated users to achieve remote code execution by deleting arbitrary system files.

This vulnerability is a path traversal flaw (CWE-22) triggered when the plugin fails to sanitize input in the field_hiddenfile and field_deleteimg POST parameters. Any authenticated user with profile editing permissions can manipulate these parameters to delete arbitrary files from the server, which can lead to remote code execution.

The ability for an authenticated user to delete arbitrary files on the hosting server poses a severe threat to business operations. An attacker could remove critical configuration files or application logic to facilitate remote code execution, resulting in full system compromise, data loss, or significant service downtime. The CVSS score of 8.8 reflects the high severity of this impact and the potential for total system compromise.

Immediate Action: There is no official vendor patch available for this legacy plugin; administrators must immediately deactivate and uninstall the Buddypress Xprofile Custom Fields Type plugin.

Proactive Monitoring: Review web server access logs for anomalous POST requests directed at profile editing endpoints that contain file path characters such as double dots or directory slashes.

Compensating Controls: Deploy a Web Application Firewall (WAF) with custom rules to block requests containing path traversal sequences in POST parameters, though migration to a supported alternative remains the only secure path.

Public Exploit Available: Yes, a published proof-of-concept exploit exists in the ExploitDB database (EDB-ID 44432).

Given the lack of vendor support and the availability of a functional exploit, this plugin represents an unacceptable risk to the environment. Security teams must prioritize the immediate removal of this software from all WordPress installations and perform an audit of the server file system to ensure no malicious artifacts were introduced prior to removal.