CVE-2026-104995 | dontdream BP Profile Search Plugin up to 5.9 on WordPress Directory AJAX bps_directory_ajax bps_directory path traversal

October 14, 2026 Yanac

A vulnerability was found in dontdream BP Profile Search Plugin up to 5.9 on WordPress. It has been declared as critical. This affects the function bps_directory_ajax of the component Directory AJAX Handler. Such manipulation of the argument bps_directory leads to path traversal.

This vulnerability is referenced as CVE-2026-104995. It is possible to launch the attack remotely. No exploit is available.VulDB Recent EntriesRead More