---
id: CVE-2018-25308
title: BuddyPress Xprofile Custom Fields Type 2.6.3 Arbitrary File Deletion
summary: >-
  BuddyPress Xprofile Custom Fields Type 2.6.3 contains an arbitrary file
  deletion vulnerability that allows authenticated users to delete arbitrary
  files by manipulating unescaped POST parameters. Attackers can modify the
  field_hiddenfile…
severity: high
cvss: 8.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'
cvssSource: cna
cwe:
  - CWE-22
vendor: donmik
product: Buddypress Xprofile Custom Fields Type
affected:
  - buddypress_xprofile_custom_fields_type 2.6.3
ssvc:
  exploitation: poc
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-04-30T12:21:55.038576Z'
exploitAvailable: true
published: '2026-04-29'
updated: '2026-10-29'
sourceUpdated: '2026-10-29T21:15:01.677Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2018-25308'
references:
  - url: 'https://www.exploit-db.com/exploits/44432'
    label: ExploitDB-44432
  - url: 'http://lenonleite.com.br/'
    label: Official Product Homepage
  - url: >-
      https://www.vulncheck.com/advisories/buddypress-xprofile-custom-fields-type-remote-code-execution
    label: >-
      VulnCheck Advisory: BuddyPress Xprofile Custom Fields Type 2.6.3 Remote
      Code Execution
tags:
  - cve.org
  - exploit-available
epss: 0.0045
epssPercentile: 0.39323
ingestedAt: '2026-11-03T08:39:35.532Z'
---

## Overview

BuddyPress Xprofile Custom Fields Type 2.6.3 contains an arbitrary file deletion vulnerability that allows authenticated users to delete arbitrary files by manipulating unescaped POST parameters. Attackers can modify the field_hiddenfile and field_deleteimg parameters during profile editing to unlink files from the server.

## Affected

- `buddypress_xprofile_custom_fields_type 2.6.3`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.