CVE-2026-9290: 
WordPress vulnerability analysis and mitigation

CVE-2026-9290 is a Local File Inclusion (LFI) vulnerability in the WP User Manager – User Profile Builder & Membership plugin for WordPress, affecting all versions up to and including 2.9.17. The flaw exists in the profile template scope function, allowing unauthenticated attackers to include and execute arbitrary PHP files on the server. It was disclosed on June 6, 2026, with the fix merged into the plugin's development branch on May 30, 2026. The vulnerability carries a CVSS v3.1 base score of 7.5 (High) (Github Advisory, Feedly).

The root cause is improper input validation of the tab query variable in the profile template scope, classified as CWE-22 (Path Traversal). Specifically, the functions wpum_get_active_profile_tab() and wpum_display_account_page_content() did not validate the user-supplied tab parameter against a whitelist of registered tabs before using it in template loading or action hooks, enabling path traversal sequences to reference arbitrary PHP files. The fix, introduced in PR #445, validates the tab input against wpum_get_registered_profile_tabs() and wpum_get_account_page_tabs() whitelists, falling back to the default tab for unregistered values. Relevant vulnerable code paths include templates/profile.php#L52, includes/functions.php#L955, and vendor-dist/gamajo/template-loader/class-gamajo-template-loader.php#L226 (Github PR #445, Github Advisory).

Successful exploitation allows an unauthenticated remote attacker to include and execute arbitrary PHP files present on the server, potentially achieving remote code execution (RCE) if PHP files can be uploaded to the server (e.g., via media upload features). Even without file upload capability, the vulnerability can be used to read sensitive server-side PHP files, bypass access controls, and expose confidential data such as WordPress configuration files containing database credentials. The CVSS scoring reflects a high confidentiality impact with no direct integrity or availability impact in the base case, though RCE scenarios significantly elevate the real-world risk (Github Advisory, Feedly).

1. Reconnaissance: Identify WordPress sites running the WP User Manager plugin (versions ≤ 2.9.17) using tools like WPScan, Shodan, or by checking /wp-content/plugins/wp-user-manager/readme.txt for version disclosure.
2. Locate the vulnerable endpoint: Navigate to a user profile page that uses the WP User Manager profile template, typically accessible at a URL like /members/{username}/ or a configured profile permalink.
3. Craft a malicious tab parameter: Append a path traversal payload to the tab query variable in the profile URL, e.g., ?tab=../../../../wp-config or using null byte injection such as ?tab=../../../../path/to/uploaded/shell.php%00, to reference a target PHP file outside the intended template directory.
4. Trigger file inclusion: Submit the crafted request; the vulnerable wpum_get_active_profile_tab() function passes the unsanitized tab value to the template loader, which resolves and includes the specified PHP file.
5. Achieve code execution or data exfiltration: If a PHP web shell was previously uploaded (e.g., via WordPress media upload), the included file executes arbitrary commands. Alternatively, including wp-config.php may expose database credentials in the server response (Github PR #445, Github Advisory).

• Network: Unusual HTTP GET/POST requests to WordPress profile URLs containing tab parameter values with path traversal sequences (e.g., ../, %2e%2e%2f, null bytes %00), or references to non-standard PHP filenames.
• Logs: WordPress or web server access logs showing requests to profile endpoints with suspicious tab query parameters; PHP error logs indicating failed file inclusion attempts or unexpected file paths being loaded.
• File System: Presence of newly uploaded PHP files in the WordPress uploads directory (/wp-content/uploads/) that are not images or standard media types; unexpected .php files in writable directories.
• Process: Unusual child processes spawned by the PHP/web server process (e.g., curl, wget, bash, python) following requests to profile pages; unexpected outbound network connections from the web server.

The vulnerability was patched in the WP User Manager plugin via PR #445 (merged May 30, 2026), which validates the tab query parameter against a whitelist of registered tabs before use in template loading. Users should upgrade the WP User Manager plugin to a version newer than 2.9.17 as soon as a patched release is available in the WordPress plugin repository. If an immediate upgrade is not possible, consider temporarily deactivating or removing the plugin, implementing WAF rules to block path traversal patterns in the tab query parameter, and restricting file upload capabilities to non-executable file types to limit RCE potential (Github PR #445, Feedly).

The vulnerability was responsibly disclosed by a researcher identified as "Yat" via Wordfence, and the plugin maintainer acknowledged and credited the report in the fix PR (Github PR #445). Wordfence included this CVE in their weekly WordPress vulnerability report for June 1–7, 2026 (Wordfence Blog). The vulnerability received attention on social media platforms including Mastodon and Bluesky shortly after disclosure, and a Nuclei detection template was contributed to the ProjectDiscovery community repository, indicating active interest from the security research community.