CVE-2026-104995

The BP Profile Search plugin for WordPress is vulnerable to Local File Inclusion in versions up to, and including, 5.9 via the 'ajax template' value parsed from the client-controlled 'bps directory' cookie during BuddyPress AJAX directory requests. The bps directory ajax() filter (hooked onto bp legacy object template path and bp nouveau object template path) reads the cookie, applies only a referer-derived 'page' comparison in bps get directory data() (where bps current page() uses HTTP REFERER during AJAX and is therefore also attacker-controlled), and then suffixes the attacker-controlled template value with '.php' and passes it to bp locate template() with no basename restriction, no whitelist, and no path-traversal check. This makes it possible for unauthenticated attackers to include arbitrary PHP files on the server, which can lead to remote code execution when PHP files can be uploaded or when images such as the default wordpress:php8.