CVE-2026-104995: BP Profile Search <= 5.9 - Unauthenticated Local File Inclusion to Remote Code Execution via 'bps_directory' Cookie 'ajax_template' Value
The BP Profile Search plugin for WordPress is vulnerable to Local File Inclusion in versions up to, and including, 5.9 via the 'ajaxtemplate' value parsed from the client-controlled 'bpsdirectory' cookie during BuddyPress AJAX directory requests. The bpsdirectoryajax() filter (hooked onto bplegacyobjecttemplatepath and bpnouveauobjecttemplatepath) reads the cookie, applies only a referer-derived 'page' comparison in bpsgetdirectorydata() (where bpscurrentpage() uses HTTPREFERER during AJAX and is therefore also attacker-controlled), and then suffixes the attacker-controlled template value with '.php' and passes it to bplocatetemplate() with no basename restriction, no whitelist, and no path-traversal check. This makes it possible for unauthenticated attackers to include arbitrary PHP files on the server, which can lead to remote code execution when PHP files can be uploaded or when images such as the default wordpress:php8.
Affected Software
Event History
Frequently Asked Questions
What conditions must be present for an attacker to achieve remote code execution?
The attacker can reach the vulnerable BuddyPress AJAX directory request without authentication and control both the bps_directory cookie’s ajax_template value and the HTTP Referer-derived page check. Remote code execution depends on a PHP file being available for inclusion, such as an uploaded PHP file or PHP files present in certain container images.
Are default installations affected?
The vulnerable template selection lacks a basename restriction, whitelist, and path-traversal validation. Exploitation targets BuddyPress AJAX directory requests, so exposure depends on the plugin being installed at version 5.9 or earlier and those requests being reachable.
What can be done if updating is not immediately possible?
Restrict or disable access to the affected BuddyPress AJAX directory functionality until the vulnerable plugin code can be updated or removed. Also prevent PHP file uploads and review the server or container image for PHP files that could be included.
How can I assess whether an installation is vulnerable?
Check whether Andrea Tarantini BP Profile Search is installed at version 5.9 or earlier. Review bps-directory.php for bps_directory_ajax() handling of the bps_directory cookie’s ajax_template value and its use in template resolution without path validation.