CVE-2026-104995: BP Profile Search WordPress RCE Vulnerability

CVE-2026-104995 Overview

CVE-2026-104995 is a Local File Inclusion (LFI) vulnerability in the BP Profile Search plugin for WordPress, affecting versions up to and including 5.9. The flaw resides in the bps_directory_ajax() filter, which reads an attacker-controlled bps_directory cookie during BuddyPress AJAX directory requests. The plugin appends .php to the supplied template value and passes it to bp_locate_template() without a whitelist, basename restriction, or path-traversal check. Unauthenticated attackers can include arbitrary PHP files on the server, which can escalate to remote code execution when PHP files are uploadable or when attacker-controllable PHP content is present on disk.

Critical Impact
Unauthenticated remote attackers can include arbitrary PHP files, leading to remote code execution under exploitable conditions.

Affected Products

BP Profile Search plugin for WordPress — versions up to and including 5.9
Fixed in BP Profile Search version 6.0
WordPress sites running BuddyPress with the vulnerable plugin enabled

Discovery Timeline

2026-10-14 - CVE-2026-104995 published to NVD
2026-10-14 - Last updated in NVD database

Technical Details for CVE-2026-104995

Vulnerability Analysis

The vulnerability is classified under CWE-98: Improper Control of Filename for Include/Require Statement in PHP Program. It stems from unsafe handling of a client-controlled cookie during AJAX directory requests. The plugin's bps_directory_ajax() function hooks onto bp_legacy_object_template_path and bp_nouveau_object_template_path, reads the bps_directory cookie, and extracts an ajax_template value from it. The only validation applied is a referer-derived page comparison inside bps_get_directory_data(). Because bps_current_page() uses HTTP_REFERER during AJAX, the comparison itself is attacker-controlled and provides no security boundary.

Root Cause

The attacker-controlled template value is concatenated with .php and passed directly to bp_locate_template() without a basename restriction, without a whitelist of allowed templates, and without any path-traversal filtering. This allows traversal sequences and arbitrary paths to resolve against the server filesystem.

Attack Vector

An unauthenticated attacker crafts a BuddyPress AJAX directory request with a forged Referer header matching the expected directory page and sets the bps_directory cookie to include an ajax_template value referencing an arbitrary path. The plugin loads the resulting PHP file via bp_locate_template(). When writable paths contain attacker-controllable PHP content, such as uploaded images or logs, the LFI escalates to remote code execution. Full source-level details are available in the BP Profile Search 5.9 source listing and the Wordfence advisory.

// No verified exploit code available. See referenced advisories for technical details.

Detection Methods for CVE-2026-104995

Indicators of Compromise

HTTP requests to WordPress AJAX endpoints containing a bps_directory cookie with suspicious ajax_template values, including path separators or traversal sequences such as ../.
Requests where the Referer header is crafted to mimic a BuddyPress directory page while the cookie carries non-standard template names.
Unexpected PHP execution originating from paths under wp-content/uploads/ or other writable directories.

Detection Strategies

Inspect web server and WordPress access logs for AJAX POST requests referencing bp_ajax_querystring or BuddyPress directory actions correlated with abnormal cookie contents.
Monitor PHP include/require activity on web hosts for paths outside the expected plugin and theme template directories.
Alert on new or modified PHP files in upload directories following requests to BuddyPress AJAX endpoints.

Monitoring Recommendations

Centralize WordPress, PHP-FPM, and web server logs for correlation and retention.
Deploy a web application firewall rule that inspects the bps_directory cookie value for path traversal patterns and non-alphanumeric characters.
Baseline normal BuddyPress AJAX template values and alert on deviations.

How to Mitigate CVE-2026-104995

Immediate Actions Required

Upgrade the BP Profile Search plugin to version 6.0 or later, which removes the unsafe template handling. See the vendor changeset.
If immediate patching is not possible, disable the BP Profile Search plugin until the update is applied.
Audit upload directories for unexpected PHP files and recently modified images containing embedded PHP payloads.

Patch Information

The maintainer addressed the issue in BP Profile Search 6.0 by rewriting the template resolution logic in bps-directory.php. Review the patched 6.0 source and the changeset 3737650 for the exact fix.

Workarounds

Block or sanitize the bps_directory cookie at the reverse proxy or WAF layer, rejecting values that contain /, \, ., or null bytes.
Restrict PHP execution in writable directories such as wp-content/uploads/ using web server configuration.
Enforce strict open_basedir and disable_functions settings in PHP to limit the impact of file inclusion.

bash

# Nginx: deny PHP execution within the uploads directory
location ~* /wp-content/uploads/.*\.php$ {
    deny all;
    return 403;
}