CVE-2026-104995: CWE-98 Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') in dontdream BP Profile Search

CVE-2026-104995 describes a Local File Inclusion vulnerability in the BP Profile Search WordPress plugin (versions <=5.9). The vulnerability arises because the 'ajax_template' value is parsed from the 'bps_directory' cookie, which is attacker-controlled. The plugin uses this value to locate templates without enforcing basename restrictions, whitelisting, or path traversal checks. The attacker can manipulate the HTTP_REFERER header to bypass the limited referer-based validation. This allows inclusion of arbitrary PHP files on the server, which can lead to remote code execution if an attacker can upload PHP files or exploit existing PHP files such as those embedded in images.

An unauthenticated attacker can exploit this vulnerability to include arbitrary PHP files on the server, leading to potential remote code execution. This compromises confidentiality, integrity, and availability of the affected system. The CVSS 3.1 score is 8.1 (High), reflecting the network attack vector, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch is available, restrict access to the plugin and disable or remove it if possible. Avoid uploading PHP files or other executable content to the server. Monitor for suspicious activity related to BuddyPress AJAX directory requests. Follow vendor updates closely for an official fix.