What is the CVSS score of CVE-2026-9290?

CVE-2026-9290 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.4%.

Is there a public PoC exploit available for CVE-2026-9290?

Yes, a public proof-of-concept exploit is available for CVE-2026-9290. Prioritise patching immediately. EPSS: 0.4%.

How to fix or mitigate CVE-2026-9290?

Within 24 hours: Inventory all WordPress installations and identify those running WP User Manager plugin versions 2.9.17 and earlier. Within 7 days: Disable or uninstall WP User Manager from all production systems; if uninstall is not feasible, implement Web Application Firewall rules to block requests containing the profile tab parameter. Within 30 days: Monitor vendor security advisories for patch release; immediately deploy the patched version once available and verify all instances are updated.

WP User Manager CVE-2026-9290

EUVD-2026-34928 HIGH

Path Traversal (CWE-22)

2026-06-06 security@wordfence.com

GHSA-83v9-496w-54wx

PHP WordPress RCE Information Disclosure Path Traversal

7.5

CVSS 3.1 · Vendor: wordfence

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Identify WordPress site running WP User Manager ≤2.9.17
Delivery

Send GET to profile URL with traversal tab parameter
Exploit

Plugin passes unvalidated tab to template loader
Execution

PHP includes attacker-chosen file
Persist

Read wp-config or execute uploaded webshell
Impact

Exfiltrate credentials or pivot to full site compromise

Vulnerability Assessment

Weakness	CWE CWE-22 OWASP Top 10:2025 A01:2025 - Broken Access Control ASVS 5.0 V5 - File Handling Path canonicalization, traversal prevention MITRE ATT&CK 2 techniques across 2 tactics: Discovery, Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. Sign in to read
Exploitation Conditions	Exploitation requires that the target WordPress site has the WP User Manager plugin installed and activated at version 2.9.17 or earlier, and that the plugin's profile pages are reachable over the network (the default deployment, since profiles are public-facing). The `tab` query variable on a profile URL must be accepted and routed through `wpum_get_active_profile_tab()` without filtering, which is the default behavior in vulnerable versions. No authentication, user interaction, or non-default configuration is required for the file-read primitive (CVSS PR:N/UI:N/AC:L). Escalation from arbitrary PHP file inclusion to remote code execution additionally requires that the attacker can place a `.php` file somewhere on the server's filesystem - for example via a separately misconfigured upload feature - which is a meaningful limiting factor distinguishing pure information disclosure from full RCE on a given target.
Impact	The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N reflects an unauthenticated, low-complexity network attack with high confidentiality impact only, hence the 7.5 base score. The description, however, explicitly notes that arbitrary PHP execution is possible when an attacker can include a `.php` file they control (for example via an avatar or media upload that lands as `.php`), so real-world impact can escalate to RCE - this is a notable mismatch worth flagging: the NVD scoring captures only the file-read primitive, not the chained code execution path. EPSS and CISA KEV data were not provided, so exploitation prevalence is unknown; no public exploit has been identified at time of analysis. Given WP User Manager's install base on public-facing WordPress sites and the unauthenticated network reachability, this should be treated as high priority despite the absence of KEV listing.
Exploit ScenarioDerived	An unauthenticated attacker sends a crafted HTTP GET request to a public profile URL with a manipulated `tab` parameter such as `?tab=../../../../wp-config` to coerce the template loader into including an arbitrary PHP file on the server, exposing database credentials or other sensitive code. If the same WordPress instance permits user uploads that can be stored with a `.php` extension (e.g., misconfigured avatar/media handling), the attacker first uploads a webshell, then references it via the traversal-controlled include to obtain full remote code execution as the web server user. The traversal payloads exercised in the upstream test suite (including `..\..\wp-config` and null-byte variants) effectively serve as a proof-of-concept template.

This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).

No patch listed yet 0.4% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Jun 06, 2026

Local File Inclusion in the WP User Manager WordPress plugin (versions through 2.9.17) allows unauthenticated remote attackers to include and execute arbitrary .php files on the server via the profile tab query parameter. The flaw stems from missing validation of the tab value before it is passed to the profile template loader, enabling path traversal to any PHP file the web server can read. No public exploit is identified at time of analysis, and the issue is not listed in CISA KEV, but POC behavior is effectively documented in the upstream fix's traversal test cases.

RemediationAI

Upstream fix available (PR https://github.com/WPUserManager/wp-user-manager/pull/445); a released patched version greater than 2.9.17 is not independently confirmed in the provided data, so administrators should monitor the plugin's WordPress.org listing and install the next release that incorporates the tab-validation change. The fix validates the tab query variable against the registered profile tabs returned by wpum_get_registered_profile_tabs() before it is used by the template loader. Until a tagged release is installed, compensating controls include disabling or deactivating the WP User Manager plugin entirely (removes the feature and any sites depending on profile pages will break), restricting access to profile URLs via a WAF rule that rejects tab query parameters containing .., /, \, or null bytes (low side effect, but bypassable via encoding), and ensuring that user-controllable upload directories cannot store files with a .php extension to prevent escalation from file read to code execution (may require tightening media/avatar upload filters and webserver-level execution rules in wp-content/uploads).

Affected VersionsENISA

WP User Manager – User Profile Builder & Membership 0 ≤2.9.17

Affected Packages

euvd wp_user_manager_user_profile_builder_membership no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

WP User Manager is a WordPress plugin providing user profiles, registration, and membership functionality. The vulnerability is a CWE-22 Path Traversal that manifests as Local File Inclusion: the tab query variable consumed by wpum_get_active_profile_tab() and related routing code (includes/functions.php, includes/permalinks.php, templates/profile.php) was passed into the Gamajo template-loader and Brain/Cortex router without being checked against the list of registered profile tabs. Because the resolved tab string is used to construct a path that PHP ultimately includes, traversal sequences like ../../wp-config or null-byte variants reach arbitrary .php files on disk, which PHP then parses and executes within the WordPress request context.

Know when PHP gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (wordfence) PRIMARY 7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Primary rating from Vendor (wordfence) · only source for this CVE.

CVSS VectorVendor: wordfence

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

DescriptionCVE.org

The WP User Manager - User Profile Builder & Membership plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.9.17 via the (profile template scope) function. This makes it possible for unauthenticated attackers to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where .php file types can be uploaded and included.

Executive ViewAI

Why It Matters

The WP User Manager WordPress plugin (versions through 2.9.17) contains a path traversal vulnerability allowing unauthenticated attackers to execute arbitrary PHP code on affected websites. Although no public exploit code has been released, the vulnerability mechanics are well-understood, significantly increasing exploitation risk. Organizations must immediately audit their WordPress installations for this plugin and implement mitigations to prevent website compromise.

Business Impact: Severe

Compensating Controls

No vendor-released patch identified at time of analysis. Interim mitigations: (1) Immediately disable or uninstall the WP User Manager plugin; (2) If the plugin must remain in use, deploy WAF rules to block requests with the profile tab parameter; (3) Implement restrictive file permissions on /wp-content/plugins/wp-user-manager/ directory; (4) Enable file integrity monitoring to detect unauthorized PHP file inclusions; (5) Review access logs for suspicious patterns indicative of exploitation attempts.

Threat Intelligence Overview

EPSS Score

0.4%

Top 36% exploitable

Exploit

POC

Public exploit code exists

Social Media

Sightings

Data Quality

7 sources

Confidence: High

EUVD

NVD

CVE.org

EPSS

Vulnrichment POC (1) CIRCL

GitHub

VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity HIGH

CISA KEV No

Public POC Yes

EPSS 0.4%

Patch available No

Active threat No

Deciding rule

HIGH severity (CVSS 7.0-8.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision

Out-of-Cycle

Exploitation

None

System Exposure· derived

Open

Automatable

Yes

Human Impact

Very High

Technical Impact

Partial

Priority Score

Low Medium High Critical

KEV: 0

EPSS: 0

CVSS: +38

PoC: +20

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Path Traversal HIGH

Path traversal exploits occur when applications use user-controlled input to construct file system paths without proper validation.

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.

Remote Code Execution CRITICAL

Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.