CVE-2018-25308

BuddyPress Xprofile Custom Fields Type 2.6.3 contains an arbitrary file deletion vulnerability that allows authenticated users to delete arbitrary files by manipulating unescaped POST parameters. Attackers can modify the field_hiddenfile and field_deleteimg parameters during profile editing to unlink files from the server.

CVSS 4.0

8.7CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

CVSS 3.1

8.8CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS

0.7% chance of exploitation in the next 30 days; higher than 54% of CVEs (scores of 2026-10-29)

CWE

CWE-22

Published

2026-04-29

Modified

2026-10-29

Record from

the NVD, synced 2026-10-29

References

• http://lenonleite.com.br/
• https://www.exploit-db.com/exploits/44432
• https://www.vulncheck.com/advisories/buddypress-xprofile-custom-fields-type-remote-code-execution

Check your stackJSON