kalengi vulnerabilities and threats

The BuddyPress XProfile Image Field plugin for WordPress versions up to 3.1.0 contains a critical path traversal vulnerability allowing unauthenticated attackers to delete arbitrary files on the server. This occurs because the plugin calls unlink() on a path derived from user-supplied signup metadata without proper path resolution or containment checks. Exploitation requires open registration and an image-type profile field on the signup form. Successful exploitation can lead to remote code execution by deleting critical files such as wp-config.php.