/Vulnerability Library

WP User Manager – User Profile Builder & Membership - Local File Inclusion

CVE-2026-9290
Verified

Description

WP User Manager – User Profile Builder & Membership plugin for WordPress <= 2.9.17 contains a local file inclusion caused by improper handling in the profile template scope function, letting unauthenticated attackers execute arbitrary PHP code, exploit requires ability to upload or control PHP files.

Severity

High

CVSS Score

7.5

Exploit Probability

3%

Affected Product

wp-user-manager

Published Date

June 10, 2026

Template Author

theamanrawat

CVE-2026-9290.yaml
7.5Score

CVSS Metrics

CVSS Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVE ID:
cve-2026-9290
CWE ID:
cwe-22

References

https://patchstack.com/database/vulnerability/wordpress-wp-user-manager-user-profile-builder-membership-plugin-2-9-17-unauthenticated-path-traversal-to-local-file-inclusion-vulnerabilityhttps://nvd.nist.gov/vuln/detail/CVE-2026-9290

Remediation Steps

Update to a version later than 2.9.17 or the latest available version.