CVE-2026-9290
published 2026-06-06CVE-2026-9290: The WP User Manager – User Profile Builder & Membership plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.9.17…
PriorityP264high7.5CVSS 3.1
AVNACLPRNUINSUCHINAN
EXPLOIT
EPSS
2.40%
82.0th percentile
The WP User Manager – User Profile Builder & Membership plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.9.17 via the (profile template scope) function. This makes it possible for unauthenticated attackers to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where .php file types can be uploaded and included.
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| wpusermanager | wp_user_manager_user_profile_builder_membership | <= 2.9.17 | — |
Detection & IOCsextracted from sources · hover to see the quote
- →Check HTTP response body for WordPress login page artifacts indicating successful LFI path traversal via the 'tab' parameter ↗
- →The LFI vector is the 'tab' parameter in the profile template scope, exploitable by unauthenticated attackers via path traversal sequences (../) ↗
- ·Exploitation requires the attacker to be able to upload or otherwise control a PHP file on the server in order to achieve code execution via LFI ↗
- ·The Nuclei template uses a two-step flow: first confirming plugin presence and version, then attempting the path traversal — both conditions must be met for a positive detection ↗
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
wpusermanager WP User Manager Plugin up to 2.9.17 on WordPress User Profile path traversal (EUVD-2026-34928)
vuldb·2026-06-06·CVSS 7.5
CVE-2026-9290 [HIGH] wpusermanager WP User Manager Plugin up to 2.9.17 on WordPress User Profile path traversal (EUVD-2026-34928)
A vulnerability classified as critical was found in wpusermanager WP User Manager Plugin up to 2.9.17 on WordPress. This impacts an unknown function of the component User Profile Handler. Such manipulation leads to path traversal.
This vulnerability is documented as CVE-2026-9290. The attack can be executed remotely. There is not any exploit available.
Upgrading the affected component is advised.
GHSA
The WP User Manager – User Profile Builder & Membership plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.9.17 via the (profile template scope) functio
ghsa_unreviewed·2026-06-06
CVE-2026-9290 [HIGH] CWE-22 The WP User Manager – User Profile Builder & Membership plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.9.17 via the (profile template scope) functio
The WP User Manager – User Profile Builder & Membership plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.9.17 via the (profile template scope) function. This makes it possible for unauthenticated attackers to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where .php file types can be uploaded and included.
No detection rules found.
Nuclei
WP User Manager – User Profile Builder & Membership - Local File Inclusion
nuclei·CVSS 7.5
CVE-2026-9290 [HIGH] WP User Manager – User Profile Builder & Membership - Local File Inclusion
WP User Manager – User Profile Builder & Membership - Local File Inclusion
WP User Manager – User Profile Builder & Membership plugin for WordPress <= 2.9.17 contains a local file inclusion caused by improper handling in the profile template scope function, letting unauthenticated attackers execute arbitrary PHP code, exploit requires ability to upload or control PHP files.
Template:
id: CVE-2026-9290
info:
name: WP User Manager – User Profile Builder & Membership - Local File Inclusion
author: theamanrawat
severity: high
description: |
WP User Manager – User Profile Builder & Membership plugin for WordPress <= 2.9.17 contains a local file inclusion caused by improper handling in the profile template scope function, letting unauthenticated attackers execute arbitrary PHP code, exploit
No writeups or analysis indexed.
https://github.com/WPUserManager/wp-user-manager/pull/445https://plugins.trac.wordpress.org/browser/wp-user-manager/tags/2.9.15/includes/functions.php#L955https://plugins.trac.wordpress.org/browser/wp-user-manager/tags/2.9.15/includes/permalinks.php#L133https://plugins.trac.wordpress.org/browser/wp-user-manager/tags/2.9.15/templates/profile.php#L52https://plugins.trac.wordpress.org/browser/wp-user-manager/tags/2.9.15/vendor-dist/brain/cortex/src/Cortex/Router/Router.php#L183https://plugins.trac.wordpress.org/browser/wp-user-manager/tags/2.9.15/vendor-dist/gamajo/template-loader/class-gamajo-template-loader.php#L226https://plugins.trac.wordpress.org/browser/wp-user-manager/tags/2.9.17/includes/functions.php#L955https://plugins.trac.wordpress.org/browser/wp-user-manager/tags/2.9.17/includes/permalinks.php#L133https://plugins.trac.wordpress.org/browser/wp-user-manager/tags/2.9.17/templates/profile.php#L52https://plugins.trac.wordpress.org/browser/wp-user-manager/tags/2.9.17/vendor-dist/brain/cortex/src/Cortex/Router/Router.php#L183https://plugins.trac.wordpress.org/browser/wp-user-manager/tags/2.9.17/vendor-dist/gamajo/template-loader/class-gamajo-template-loader.php#L226https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3554574%40wp-user-manager&new=3554574%40wp-user-manager&sfp_email=&sfph_mail=https://www.wordfence.com/threat-intel/vulnerabilities/id/7a5e08d8-c6ef-42a3-9599-28c3bfb35017?source=cve
2026-06-06
Published