The BP Profile Search plugin for WordPress is vulnerable to Local File Inclusion in versions up to, and including, 5.9 via the 'ajaxtemplate' value parsed from the client-controlled 'bpsdirectory' cookie during BuddyPress AJAX directory requests. The bpsdirectoryajax() filter (hooked onto bplegacyobjecttemplatepath and bpnouveauobjecttemplatepath) reads the cookie, applies only a referer-derived 'page' comparison in bpsgetdirectorydata() (where bpscurrentpage() uses HTTPREFERER during AJAX and is therefore also attacker-controlled), and then suffixes the attacker-controlled template value with '.php' and passes it to bplocatetemplate() with no basename restriction, no whitelist, and no path-traversal check. This makes it possible for unauthenticated attackers to include arbitrary PHP files on the server, which can lead to remote code execution when PHP files can be uploaded or when images such as the default wordpress:php8.