CVE-2026-9290

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-9290

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-9290.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-9290

Published

2026-06-05T23:28:26.787Z

Modified

2026-07-08T08:12:09.269814161Z

Severity

7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CVSS Calculator

Summary

WP User Manager <= 2.9.17 - Unauthenticated Path Traversal to Local File Inclusion via 'tab' Query Parameter

Details

The WP User Manager – User Profile Builder & Membership plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.9.17 via the (profile template scope) function. This makes it possible for unauthenticated attackers to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where .php file types can be uploaded and included.

Database specific

{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/9xxx/CVE-2026-9290.json",
    "cna_assigner": "Wordfence",
    "cwe_ids": [
        "CWE-22"
    ]
}

References

Affected packages

Git / github.com/wpusermanager/wp-user-manager

Affected ranges

Type

GIT

Repo

https://github.com/wpusermanager/wp-user-manager

Events

Introduced

Last affected

b10a593d26911a6b552c45451662e436ce778bd0

Database specific

{
    "source": "AFFECTED_FIELD",
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "last_affected": "2.9.17"
        }
    ]
}

Affected versions

2.*

2.0.0-beta

2.1.10

2.1.11

2.1.12

2.1.13

2.1.14

2.1.9

2.2

2.2.1

2.2.3

2.3

2.3.1

2.3.13

2.3.2

2.3.3

2.3.4

2.3.5

2.3.6

2.3.7

2.3.8

2.3.9

2.4

2.6.1

v2.*

v2.9.14

v2.9.15

v2.9.16

v2.9.17

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-9290.json"