The BP Profile Search WordPress plugin contains a Local File Inclusion vulnerability that allows an unauthenticated user to supply an attacker‑controlled value for the 'ajax_template' parameter through the 'bps_directory' cookie. The plugin unconditionally appends ‘.php’ to this value and passes it to the template loader without any basename restriction or whitelist, enabling inclusion of arbitrary PHP files. Because uploaded PHP files or even the default WordPress php8 snippet can be placed under a directory referenced by the cookie, an attacker can execute arbitrary code on the host. Affected systems are sites running the BP Profile Search plugin by dontdream, in any release up to and including 5.9. The vulnerability has been discovered in the 5.9 release and mitigated in later 6.0 code. The plugin integrates with BuddyPress AJAX directory requests, so the flaw is triggered without needing user authentication. The CVSS score of 8.1 signals a high impact, while the EPSS score is less than 1 % indicating a low current exploitation probability. The vulnerability is not listed in the CISA KEV catalog. An attacker can reach the vulnerable endpoint via a crafted cookie, so the attack vector is local but does not require prior authentication. Once the attacker gains file inclusion, remote code execution follows if they can supply a PHP file, making the risk very serious for site owners.

Sites running the BP Profile Search plugin (dontdream) on versions up to 5.9 are affected.

The CVSS score of 8.1 signals a high impact, while the EPSS score is less than 1 % indicating a low current exploitation probability. The vulnerability is not listed in the CISA KEV catalog. An attacker can reach the vulnerable endpoint via a crafted cookie, so the attack vector is local but does not require prior authentication. Once the attacker gains file inclusion, remote code execution follows if they can supply a PHP file, making the risk very serious for site owners.