CVE-2026-104995— BP Profile Search <= 5.9 - Unauthenticated Local File Inclusion to Remote Code Execution via 'bps_directory' Cookie 'ajax_template' Value
Quick assessment
Affected
dontdream BP Profile Search
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
WordPress 插件 BP Profile Search 在 5.9 及更低版本中存在本地文件包含（Local File Inclusion, LFI）漏洞。该漏洞源于在 BuddyPress AJAX 目录请求过程中，插件解析了来自客户端控制的 Cookie 中的 参数。 具体而言， 函数（挂钩到 和 ）会读取该 Cookie，并在 函数中仅进行一个基于 Referer 派生的 比较（其中 在 AJAX 请求中使用 HTTP_REFERER，因此该值也可被攻击者控制）。随后，插件将攻击者可控的模板值加上 后缀
Possible ATT&CK Techniques 3 AI
T1055 · Process Injection T1203 · Exploitation for Client Execution T1059 · Command and Scripting Interpreter
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-104995
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
BP Profile Search <= 5.9 - Unauthenticated Local File Inclusion to Remote Code Execution via 'bps_directory' Cookie 'ajax_template' Value
Source: CVE Program / CVE List V5
Vulnerability Description
The BP Profile Search plugin for WordPress is vulnerable to Local File Inclusion in versions up to, and including, 5.9 via the 'ajax_template' value parsed from the client-controlled 'bps_directory' cookie during BuddyPress AJAX directory requests. The bps_directory_ajax() filter (hooked onto bp_legacy_object_template_path and bp_nouveau_object_template_path) reads the cookie, applies only a referer-derived 'page' comparison in bps_get_directory_data() (where bps_current_page() uses HTTP_REFERER during AJAX and is therefore also attacker-controlled), and then suffixes the attacker-controlled template value with '.php' and passes it to bp_locate_template() with no basename restriction, no whitelist, and no path-traversal check. This makes it possible for unauthenticated attackers to include arbitrary PHP files on the server, which can lead to remote code execution when PHP files can be uploaded or when images such as the default wordpress:php8.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
PHP程序中Include/Require语句包含文件控制不恰当(PHP远程文件包含)
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| dontdream | BP Profile Search | 0 ~ 5.9 | - |
|
II. Public POCs for CVE-2026-104995
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-104995
请登录查看更多情报信息。
Other References for CVE-2026-104995 (6)
IV. Related Vulnerabilities
Same weakness: CWE-98
-
CVE-2026-66566
WordPress Ambient theme <= 1.7 - Local File Inclusion vulner -
CVE-2026-62115
WordPress KuteShop theme <= 4.2.9 - Local File Inclusion vul -
CVE-2026-62099
WordPress Boutique theme <= 2.3.3 - Local File Inclusion vul -
CVE-2026-62096
WordPress Biolife theme <= 3.2.3 - Local File Inclusion vuln -
CVE-2026-62094
WordPress TechOne theme <= 3.0.3 - Local File Inclusion vuln
V. Comments for CVE-2026-104995
No comments yet