The BuddyPress XProfile Image Field plugin for WordPress up to version 3.1.0 contains a critical vulnerability allowing unauthenticated attackers to delete arbitrary files on the server. This occurs due to improper handling of file paths in the user activation process, enabling deletion of sensitive files like wp-config.php. Exploitation requires open registration and an image-type profile field on the signup form.