CVE-2025-14997: 
WordPress vulnerability analysis and mitigation

CVE-2025-14997 is an arbitrary file deletion vulnerability in the BuddyPress Xprofile Custom Field Types plugin for WordPress, caused by insufficient file path validation in the delete_field function. It affects all versions up to and including 1.2.8, and was disclosed on January 6, 2026, by Wordfence. Authenticated attackers with Subscriber-level access or above can exploit this flaw to delete arbitrary server files, which can lead to remote code execution (e.g., by deleting wp-config.php). The CVSS v3.1 base score is 8.8 (High), as assigned by Wordfence (Wordfence).

The root cause is CWE-22 (Improper Limitation of a Pathname to a Restricted Directory — Path Traversal). The vulnerable delete_field function in src/handlers/class-field-upload-helper.php does not properly validate or sanitize the file path supplied by the user before performing file deletion operations, allowing path traversal sequences to escape the intended directory. An attacker with at minimum a Subscriber-level WordPress account can craft a request specifying an arbitrary file path on the server. No user interaction beyond authentication is required, and the attack is conducted over the network with low complexity (Wordfence, Plugin Source).

Successful exploitation allows an authenticated attacker to delete any file accessible to the web server process on the host. Deleting critical WordPress files such as wp-config.php forces WordPress into a re-installation state, which an attacker can exploit to reconfigure the site with attacker-controlled database credentials, effectively achieving remote code execution and full site takeover. This results in high confidentiality, integrity, and availability impact, and could facilitate lateral movement or persistent access within the hosting environment (Wordfence).

No public proof-of-concept exploit code has been identified at this time, and there is no confirmed evidence of in-the-wild exploitation. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.0061 (0.61%), indicating a currently low probability of exploitation in the near term. However, the low privilege requirement (Subscriber-level) makes this accessible to a broad range of potential attackers on sites with open user registration (Wordfence, Wordfence Weekly Report).

1. Reconnaissance: Identify WordPress sites running the BuddyPress Xprofile Custom Field Types plugin version ≤1.2.8 using tools like WPScan or by checking the plugin's readme.txt file at wp-content/plugins/bp-xprofile-custom-field-types/readme.txt.
2. Obtain Subscriber Access: Register a standard user account on the target WordPress site (if open registration is enabled) or use compromised low-privilege credentials.
3. Identify the Vulnerable Endpoint: Locate the AJAX action or form handler tied to the delete_field function in the plugin's upload helper class.
4. Craft Malicious Request: Submit an authenticated HTTP request to the vulnerable endpoint with a path traversal payload in the file path parameter (e.g., ../../wp-config.php) to target a critical file outside the intended upload directory.
5. Trigger File Deletion: The server processes the unsanitized path and deletes the specified file (e.g., wp-config.php).
6. Achieve Remote Code Execution: With wp-config.php deleted, WordPress enters setup mode. The attacker navigates to the WordPress installation wizard and supplies attacker-controlled database credentials, gaining full administrative control and the ability to execute arbitrary code (Wordfence, Plugin Changeset).

• Logs: WordPress access logs showing authenticated POST requests to plugin AJAX endpoints (e.g., wp-admin/admin-ajax.php) with path traversal sequences (../, %2e%2e%2f) in parameters from low-privilege user accounts.
• File System: Unexpected absence of critical WordPress files such as wp-config.php, wp-settings.php, or other core files; timestamps of file deletions correlating with suspicious login events.
• Logs: WordPress debug logs or PHP error logs recording file deletion operations or errors referencing paths outside the plugin's upload directory.
• Network: Repeated requests to the WordPress setup/installation page (wp-admin/setup-config.php or wp-admin/install.php) shortly after a file deletion event, potentially from a different IP than the deletion request.
• Logs: New WordPress administrator accounts created shortly after the deletion event, indicating exploitation of the re-installation vector.

Users should update the BuddyPress Xprofile Custom Field Types plugin to version 1.2.9 or later, which addresses the path traversal vulnerability as reflected in the plugin changeset (Plugin Changeset). If an immediate update is not possible, site administrators should disable the plugin until a patch can be applied. Additionally, restricting user registration on the WordPress site reduces the attack surface by limiting who can obtain the minimum required Subscriber-level access. Implementing a Web Application Firewall (WAF) with rules to detect path traversal patterns can provide an additional layer of defense (Wordfence).

Wordfence disclosed the vulnerability and published it in their weekly WordPress vulnerability report for the week of January 5–11, 2026, highlighting it as a notable risk due to the low privilege requirement and potential for RCE (Wordfence Weekly Report). CISA included the CVE in their vulnerability bulletin for the week of January 5, 2026, indicating broader government awareness (CISA Bulletin). Community aggregators such as VulDB, Vulners, and RedPacket Security also picked up and redistributed the advisory shortly after disclosure.