CVE-2026-104995 | CVSS: 8.1 | 严重级别: HIGH
The BP Profile Search plugin for WordPress is vulnerable to Local File Inclusion in versions up to, and including, 5.9 via the 'ajax_template' value parsed from the client-controlled 'bps_directory' cookie during BuddyPress AJAX directory requests. The bps_directory_ajax() filter (hooked onto bp_legacy_object_template_path and bp_nouveau_object_template_path) reads the cookie, applies only a referer-derived 'page' comparison in bps_get_directory_data() (where bps_current_page() uses HTTP_REFERER during AJAX and is therefore also attacker-controlled), and then suffixes the attacker-controlled t
参考链接:
• https://plugins.trac.wordpress.org/browser/bp-profile-search/tags/5.9/bps-direct
• https://plugins.trac.wordpress.org/browser/bp-profile-search/tags/5.9/bps-direct
• https://plugins.trac.wordpress.org/browser/bp-profile-search/tags/5.9/bps-search
📌 数据来源: NVD 官方