BP Profile Search EUVD-2026-100768

Requires the BP Profile Search plugin (<= 5.9) active on a WordPress site with BuddyPress installed, since the flaw is in the bps_directory_ajax() filter hooked onto bp_legacy_object_template_path/bp_nouveau_object_template_path during BuddyPress AJAX directory requests. The LFI primitive needs no authentication and no special configuration: the attacker fully controls the 'ajax_template' value via the 'bps_directory' cookie and controls the referer-derived 'page' comparison via HTTP_REFERER during AJAX, and there is no basename restriction, whitelist, or path-traversal check. The escalation to remote code execution is LIMITED by one real prerequisite - an includable PHP file must already be present on the server (e.g., a separate file-upload capability allowing PHP, or default container images such as wordpress:php8); without such a file the attacker is constrained to including existing server-side PHP, which still risks information disclosure and unintended code execution.

This is a genuine high-priority issue, not an inflated CVSS score. The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N) describes an unauthenticated, network-reachable flaw with high impact to confidentiality, integrity, and availability (C:H/I:H/A:H), consistent with CWE-98 PHP Local File Inclusion that can escalate to remote code execution. The AC:H rating is the key tempering signal: while the LFI primitive itself is easy to reach (the attacker controls both the 'bps_directory' cookie and the HTTP_REFERER used for the 'page' comparison), turning inclusion into full RCE requires an includable PHP payload already present on disk (an uploadable PHP file, or default images such as wordpress:php8), which raises practical complexity. No EPSS score was provided in the input, so exploitation probability cannot be quantified. The vulnerability is NOT listed in CISA KEV and no public proof-of-concept is referenced, so the correct status is no public exploit identified at time of analysis. Conflicting-signal note: the description characterizes exploitation as unauthenticated and remote (aligning with PR:N/AV:N), but full code execution is contingent on server-side conditions not guaranteed in every deployment - defenders should treat the baseline (arbitrary PHP file inclusion / information disclosure) as always-on and RCE as condition-dependent. Because it was reported by Wordfence (a reputable WordPress security vendor) and affects all versions up to and including 5.9 with a fix in 6.0, patching should be prioritized for any site running this plugin.

An unauthenticated attacker sends a BuddyPress AJAX directory request to a WordPress site running BP Profile Search, setting a crafted 'bps_directory' cookie whose 'ajax_template' value points at an arbitrary path and spoofing the HTTP Referer to satisfy the page comparison; the plugin appends '.php' and passes it to bp_locate_template() with no whitelist or traversal check, including attacker-chosen PHP. If an includable PHP file exists on the server (via a separate upload vector or default container images like wordpress:php8), this yields remote code execution. No public exploit code is referenced at time of analysis, but the vulnerable code paths are documented in the public plugin source (trac).