CVE-2026-104995

8.1High

Published 14 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash

8.1High

Attack vector: Network
Complexity: High
Privileges needed: None
User interaction: None
Impact: Full C/I/A compromise
Weakness: CWE-98

Impact

Unauthenticated remote attackers can execute arbitrary code on the web server by including local PHP or uploaded files. They only need network access to send crafted HTTP requests with manipulated cookies and referer headers.

Root cause

The plugin appends a '.php' suffix to the user-supplied 'ajax_template' cookie value and passes it to bp_locate_template() without path traversal validation or whitelisting.

Affected systems

BP Profile Search plugin for WordPress versions up to and including 5.9

CVSS v3.1 · CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Fix & remediation

Upgrade the BP Profile Search plugin to version 6.0 or later. If unable to update immediately, deactivate or remove the plugin via WP-CLI.

shell

$ wp plugin update bp-profile-search

AI-suggested. Run it in staging first and check it against the vendor advisory. Why?

Ad · In-content banner

NVD description

The BP Profile Search plugin for WordPress is vulnerable to Local File Inclusion in versions up to, and including, 5.9 via the 'ajax_template' value parsed from the client-controlled 'bps_directory' cookie during BuddyPress AJAX directory requests. The bps_directory_ajax() filter (hooked onto bp_legacy_object_template_path and bp_nouveau_object_template_path) reads the cookie, applies only a referer-derived 'page' comparison in bps_get_directory_data() (where bps_current_page() uses HTTP_REFERER during AJAX and is therefore also attacker-controlled), and then suffixes the attacker-controlled template value with '.php' and passes it to bp_locate_template() with no basename restriction, no whitelist, and no path-traversal check. This makes it possible for unauthenticated attackers to include arbitrary PHP files on the server, which can lead to remote code execution when PHP files can be uploaded or when images such as the default wordpress:php8.

References

Source: nvd.nist.gov/vuln/detail/CVE-2026-104995