CVE-2025-14997 is a path traversal vulnerability (CWE-22) in the BuddyPress Xprofile Custom Field Types WordPress plugin (versions up to 1.2.8). The issue arises from inadequate validation of file paths in the 'delete_field' function, enabling authenticated users with Subscriber-level privileges or higher to delete arbitrary files on the server. This arbitrary file deletion can facilitate remote code execution by removing critical files such as wp-config.php. The vulnerability has a CVSS 3.1 score of 8.8, indicating high impact on confidentiality, integrity, and availability. No patch or official fix has been documented, and no exploits are currently known in the wild.

An attacker with at least Subscriber-level access can delete arbitrary files on the server hosting the vulnerable plugin. This can compromise server integrity and availability, and potentially lead to remote code execution if key files like wp-config.php are deleted. The impact affects confidentiality, integrity, and availability of the affected system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict user roles and permissions to trusted users only, and monitor for suspicious activity related to file deletions. Avoid granting Subscriber-level or higher access to untrusted users.