diff --git a/src/Composer/Command/CreateProjectCommand.php b/src/Composer/Command/CreateProjectCommand.php
index 7f7487dea..826f41c86 100644
--- a/src/Composer/Command/CreateProjectCommand.php
+++ b/src/Composer/Command/CreateProjectCommand.php
@@ -403,7 +403,7 @@ EOT
             throw new \InvalidArgumentException('Invalid stability provided ('.$stability.'), must be one of: '.implode(', ', array_keys(BasePackage::$stabilities)));
         }
 
-        $composer = Factory::create($io, $config->all(), $disablePlugins === true ? true : 'local', $disableScripts);
+        $composer = Factory::create($io, $config->all(), $disablePlugins, $disableScripts);
         $config = $composer->getConfig();
         $rm = $composer->getRepositoryManager();
 
diff --git a/src/Composer/Factory.php b/src/Composer/Factory.php
index 84c229603..609c1cc24 100644
--- a/src/Composer/Factory.php
+++ b/src/Composer/Factory.php
@@ -646,6 +646,14 @@ class Factory
     {
         $factory = new static();
 
+        // for BC reasons, if a config is passed in either as array or a path that is not the default composer.json path
+        // we disable local plugins as they really should not be loaded from CWD
+        // If you want to avoid this behavior, you should be calling createComposer directly with a $cwd arg set correctly
+        // to the path where the composer.json being loaded resides
+        if ($config !== null && $config !== self::getComposerFile() && $disablePlugins === false) {
+            $disablePlugins = 'local';
+        }
+
         return $factory->createComposer($io, $config, $disablePlugins, null, true, $disableScripts);
     }