CVE-2026-104995 dontdream CVE debrief

Who should care

Defenders responsible for WordPress installations with the BP Profile Search plugin version 5.9 or earlier should assess exposure and potential impact. This includes operators, platform administrators, vulnerability management teams, and security teams who need to verify exposure, evaluate potential impact, and plan remediation efforts.

Why it matters

The BP Profile Search plugin vulnerability allows unauthenticated attackers to include arbitrary PHP files, potentially leading to remote code execution. Defenders should prioritize verifying exposure and assessing impact.

• Unauthenticated attackers can include arbitrary PHP files on the server.
• Remote code execution is possible when PHP files can be uploaded or when images with PHP code are present.
• Defenders need to verify exposure and assess potential impact.
• Remediation priority is high for unauthenticated access and PHP file inclusion.

Technical summary

The BP Profile Search plugin for WordPress is vulnerable to Local File Inclusion in versions up to, and including, 5.9 via the 'ajax_template' value parsed from the client-controlled 'bps_directory' cookie during BuddyPress AJAX directory requests. The bps_directory_ajax() filter reads the cookie, applies only a referer-derived 'page' comparison, and then suffixes the attacker-controlled template value with '.php' and passes it to bp_locate_template() with no basename restriction, no whitelist, and no path-traversal check.

Defensive priority

Defenders should prioritize verifying exposure and assessing potential impact, focusing on unauthenticated access and PHP file inclusion.

Recommended defensive actions

• Verify exposure by checking if the BP Profile Search plugin version is 5.9 or earlier.
• Assess potential impact by evaluating if PHP files can be uploaded or if images with PHP code are present.
• Consider upgrading to a patched version of the plugin, if available.
• Monitor for potential exploitation attempts.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The CVE record and source item provide details on the vulnerability, including the affected version and potential impact. Defenders should verify exposure by checking if the BP Profile Search plugin version is 5.9 or earlier and assess potential impact by evaluating if PHP files can be uploaded or if images with PHP code are present. The bps_directory_ajax() filter reads the cookie, applies only a referer-derived 'page' comparison, and then suffixes the attacker-controlled template value with '.php' and passes it to bp_locate_template

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.