buddypress-xprofile-custom-fields-type 2.6.3 - Authenticated Arbitrary File Deletion

Description

Type user access: any user registered used in BuddyPress.

$_POST[ 'field_' . $field_id . '_hiddenfile' ] is not escaped.
$_POST[ 'field_' . $field_id . '_deleteimg' ] is not escaped.
Code
File: wp-conent/plugin/buddypress-xprofile-custom-fields-type/bp-xprofile-custom-fields-type.php Lines: 452, 472, 496, 513, 568, 579 Examples:
unlink( $uploads['basedir'] . $_POST[ 'field_' . $field_id . '_hiddenfile' ] );
unlink( $uploads['basedir'] . $_POST[ 'field_' . $field_id . '_hiddenimg' ] );