A critical arbitrary file deletion vulnerability in the BuddyPress Xprofile Custom Field Types plugin allows authenticated attackers to potentially achieve remote code execution.

The plugin fails to properly validate file paths within the delete_field function, which permits authenticated users with Subscriber-level access or higher to delete arbitrary files on the server. Deleting critical system files such as wp-config.php can facilitate full site takeover and remote code execution.

Successful exploitation of this vulnerability poses a severe risk to the integrity and availability of the WordPress environment. By deleting core configuration files, an attacker can force a site re-installation or bypass security controls, leading to total unauthorized control over the web application. Given the CVSS score of 7.2, the potential for remote code execution renders this a high-priority risk for any organization utilizing this plugin.

Immediate Action: Since no official patch version is currently confirmed, administrators should immediately deactivate and remove the BuddyPress Xprofile Custom Field Types plugin from their WordPress installation until a secure update is released.

Proactive Monitoring: Monitor server file system access logs for suspicious deletion activity originating from authenticated Subscriber-level user accounts.

Compensating Controls: Implement a Web Application Firewall (WAF) to detect and block path traversal patterns, although complete removal of the vulnerable component remains the only guaranteed mitigation.

Public Exploit Available: No

The vulnerability represents a significant security oversight that exposes the underlying server to complete compromise by low-privileged users. Organizations must prioritize the removal of the affected plugin to eliminate the attack surface immediately. Continue to monitor vendor communications for the release of a patched version before considering re-deployment.