What is the CVSS score of CVE-2026-9290?

CVE-2026-9290 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.4%.

Which versions of WP User Manager are affected by CVE-2026-9290?

The WP User Manager WordPress plugin (versions through 2.9.17) contains a path traversal vulnerability allowing unauthenticated attackers to execute arbitrary PHP code on affected websites.

Is there a public PoC exploit available for CVE-2026-9290?

Yes, a public proof-of-concept exploit is available for CVE-2026-9290. Prioritise patching immediately. EPSS: 0.4%.

How to fix or mitigate CVE-2026-9290?

Within 24 hours: Inventory all WordPress installations and identify those running WP User Manager plugin versions 2.9.17 and earlier. Within 7 days: Disable or uninstall WP User Manager from all production systems; if uninstall is not feasible, implement Web Application Firewall rules to block requests containing the profile tab parameter. Within 30 days: Monitor vendor security advisories for patch release; immediately deploy the patched version once available and verify all instances are updated.

WP User Manager CVE-2026-9290

EUVD-2026-34928 HIGH

Path Traversal (CWE-22)

2026-06-06 security@wordfence.com

GHSA-83v9-496w-54wx

WordPress Path Traversal RCE PHP Information Disclosure

7.5

CVSS 3.1 · Vendor: wordfence

Severity by source

Vendor (wordfence) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Primary rating from Vendor (wordfence) · only source for this CVE.

CVSS VectorVendor: wordfence

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Source Code Evidence Fetched

Jun 06, 2026 - 00:28 vuln.today

Analysis Generated

Jun 06, 2026 - 00:28 vuln.today

CVE Published

Jun 06, 2026 - 00:16 nvd

HIGH 7.5

DescriptionCVE.org

The WP User Manager - User Profile Builder & Membership plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.9.17 via the (profile template scope) function. This makes it possible for unauthenticated attackers to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where .php file types can be uploaded and included.

AnalysisAI

Local File Inclusion in the WP User Manager WordPress plugin (versions through 2.9.17) allows unauthenticated remote attackers to include and execute arbitrary .php files on the server via the profile tab query parameter. The flaw stems from missing validation of the tab value before it is passed to the profile template loader, enabling path traversal to any PHP file the web server can read. No public exploit is identified at time of analysis, and the issue is not listed in CISA KEV, but POC behavior is effectively documented in the upstream fix's traversal test cases.

Technical ContextAI

WP User Manager is a WordPress plugin providing user profiles, registration, and membership functionality. The vulnerability is a CWE-22 Path Traversal that manifests as Local File Inclusion: the tab query variable consumed by wpum_get_active_profile_tab() and related routing code (includes/functions.php, includes/permalinks.php, templates/profile.php) was passed into the Gamajo template-loader and Brain/Cortex router without being checked against the list of registered profile tabs. Because the resolved tab string is used to construct a path that PHP ultimately includes, traversal sequences like ../../wp-config or null-byte variants reach arbitrary .php files on disk, which PHP then parses and executes within the WordPress request context.

RemediationAI

Upstream fix available (PR https://github.com/WPUserManager/wp-user-manager/pull/445); a released patched version greater than 2.9.17 is not independently confirmed in the provided data, so administrators should monitor the plugin's WordPress.org listing and install the next release that incorporates the tab-validation change. The fix validates the tab query variable against the registered profile tabs returned by wpum_get_registered_profile_tabs() before it is used by the template loader. Until a tagged release is installed, compensating controls include disabling or deactivating the WP User Manager plugin entirely (removes the feature and any sites depending on profile pages will break), restricting access to profile URLs via a WAF rule that rejects tab query parameters containing .., /, \, or null bytes (low side effect, but bypassable via encoding), and ensuring that user-controllable upload directories cannot store files with a .php extension to prevent escalation from file read to code execution (may require tightening media/avatar upload filters and webserver-level execution rules in wp-content/uploads).