8.8Hoch

CVE-2018-25308BuddyPress Xprofile Custom Fields Type 2.6.3 Arbitrary File Deletion

donmik Buddypress Xprofile Custom Fields Type Veröffentlicht: 2026-04-29 22:24 (vor 6 Monaten)

Beschreibung

BuddyPress Xprofile Custom Fields Type 2.6.3 contains an arbitrary file deletion vulnerability that allows authenticated users to delete arbitrary files by manipulating unescaped POST parameters. Attackers can modify the field_hiddenfile and field_deleteimg parameters during profile editing to unlink files from the server.

Schwachstellentyp (CWE): CWE-22

Daten: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Wiedergegeben wie in der Quelle, auf Englisch.

Betroffene Produkte und Versionen

Hersteller	Produkt	Versionen
buddypress	buddypress	2.6.3
donmik	Buddypress Xprofile Custom Fields Type	2.6.3

Referenzen und Patches

ExploitDB-44432 exploit
Official Product Homepage product
VulnCheck Advisory: BuddyPress Xprofile Custom Fields Type 2.6.3 Remote Code Execution third-party-advisory

CVSS-Score

8.8Hoch

Quelle: VulnCheck · CVSS 3.1

Angriffsvektor: Netzwerk
Komplexität: Niedrig
Rechte erforderlich: Niedrig
Benutzerinteraktion: Keine
Geltungsbereich: Unverändert
Vertraulichkeit: Hoch
Integrität: Hoch
Verfügbarkeit: Hoch

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Alle Scores (4)

cna	CVSS 4.0	8.7Hoch
cna	CVSS 3.1	8.8Hoch
disclosure@vulncheck.com	CVSS 4.0	8.7Hoch
disclosure@vulncheck.com	CVSS 3.1	8.8Hoch

EPSS (Ausnutzungswahrscheinlichkeit in 30 Tagen)

0.45%

höher als 40 % aller CVEs

CISA-Bewertung (SSVC)

Ausnutzung: poc
Automatisierbar: no
Technische Auswirkung: total

Zeitverlauf

ID reserviert2026-04-29
Veröffentlicht2026-04-29 22:24
Bei IP-DB eingegangen2026-10-25 00:05
Zuletzt aktualisiert2026-10-30 00:17

Vergeben von (CNA): VulnCheck
NVD-Status: Deferred

In der Quelle ansehen: CVE.org · NVD

Benachrichtigung bei neuen Schwachstellen in diesen Produkten

E-Mail-Warnungen aktivieren

Kostenlos · mit Konto · jederzeit abbestellbar

Neue CVEs im selben Produkt — WordPress plugins & themes

7.5Hoch

CVE-2026-82663 vor 1 Stunde

Give - Peer-to-Peer <= 2.9.5 - Authorization Bypass to Team Modification and Media Upload

GiveWP Give - Peer-to-Peer

The Give - Peer-to-Peer plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.9.5. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthe…

7.5Hoch

CVE-2026-82568 vor 1 Stunde

Give - Peer-to-Peer <= 2.9.3 - Unauthenticated SQL Injection via 'sort' Parameter

GiveWP Give - Peer-to-Peer

The Give - Peer-to-Peer plugin for WordPress is vulnerable to time-based SQL Injection via the 'sort' parameter in all versions up to, and including, 2.9.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the e…

Ohne Score

CVE-2026-124671 vor 5 Stunden

Burst Statistics < 3.7.5 - Unauthenticated Analytics Disclosure Beyond Shared Report Date Range

Burst Statistics

The Burst Statistics WordPress plugin before 3.7.5 does not enforce a shared report's date range on the analytics it serves to the report's share link, allowing anyone holding the link to read the report's statistics for any period the site retains rather th…

Ohne Score

CVE-2026-124673 vor 5 Stunden

Burst Statistics < 3.7.5 - Unauthenticated Draft and Private Post Title Disclosure via Forged Page View

Burst Statistics

The Burst Statistics WordPress plugin before 3.7.5 does not check that a reported page view belongs to published content, nor check post status before listing post titles and links in its public statistics output, allowing unauthenticated attackers to disclo…

Ohne Score

CVE-2026-127048 vor 5 Stunden

Lazy Blocks < 3.0.0 - Unauthenticated RCE

Custom Block Builder

The Custom Block Builder WordPress plugin before 3.0.0 does not properly deny unauthorised requests to its REST routes, as its permission checks return a non-error response that WordPress treats as granted, allowing unauthenticated users to execute arbitrary…

Ohne Score

CVE-2026-110989 vor 5 Stunden

RegistrationMagic 5.2.3.1 - 6.1.0.3 - Unauthenticated Non-Admin User Profile Modification via Form Submission

RegistrationMagic

The RegistrationMagic WordPress plugin before 6.1.0.4 does not verify ownership of the submitted email address before updating the associated WordPress user account, allowing unauthenticated attackers to overwrite the profile fields of arbitrary non-administ…