CVE-2026-49766: WP User Manager Path Traversal Flaw

CVE-2026-49766 Overview

CVE-2026-49766 is a path traversal vulnerability [CWE-22] in the WP User Manager WordPress plugin that allows authenticated subscriber-level users to delete arbitrary files on the server. The flaw affects WP User Manager versions 2.9.16 and earlier. Successful exploitation enables low-privileged accounts to remove critical files such as wp-config.php, which can trigger WordPress site takeover by forcing the site into a fresh installation state. The vulnerability requires only a subscriber account, the lowest authenticated role in WordPress.

Critical Impact
An authenticated subscriber can delete arbitrary files on the WordPress server, leading to full site compromise when wp-config.php is removed and the attacker reinitializes the installation.

Affected Products

WP User Manager WordPress plugin versions <= 2.9.16
WordPress sites with subscriber registration enabled and the vulnerable plugin installed
Multisite WordPress deployments running affected versions of WP User Manager

Discovery Timeline

2026-06-15 - CVE-2026-49766 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2026-49766

Vulnerability Analysis

The vulnerability is an arbitrary file deletion flaw classified as path traversal [CWE-22]. WP User Manager exposes functionality that accepts a file path or identifier from an authenticated user and removes the referenced file. The plugin does not properly validate or canonicalize the supplied path. As a result, an attacker can supply traversal sequences such as ../ to escape the intended directory and target files anywhere on the filesystem accessible to the web server user.

The attack requires only subscriber-level privileges. WordPress sites that allow open user registration grant any visitor this capability after registering an account. The scope-changed CVSS vector indicates that exploitation affects resources beyond the vulnerable component, consistent with the ability to remove files outside the plugin directory.

Deleting wp-config.php is the typical impact path. WordPress treats the absence of this file as an uninitialized installation and triggers the setup wizard on the next request. An attacker who reaches the setup wizard can point the site at a database they control, effectively taking over the site and gaining administrative access.

Root Cause

The root cause is insufficient input validation on file path parameters used in a deletion routine. The plugin trusts user-supplied input and resolves it relative to a directory without enforcing a canonical path within an allow-listed location. Refer to the Patchstack Vulnerability Report for additional technical context.

Attack Vector

The attack is remote and network-based over HTTP/HTTPS. The attacker authenticates as a subscriber and sends a crafted request to the vulnerable plugin endpoint. The request includes a path containing traversal sequences pointing to a sensitive file. The plugin processes the request and removes the targeted file with the privileges of the web server user.

Detection Methods for CVE-2026-49766

Indicators of Compromise

HTTP requests to WP User Manager endpoints containing ../ or URL-encoded traversal sequences such as %2e%2e%2f in file or path parameters
Unexpected deletion of wp-config.php, .htaccess, or core WordPress files on hosts running the plugin
WordPress installation wizard appearing on a previously configured site, indicating wp-config.php removal
New administrative accounts created shortly after suspicious DELETE-related requests to plugin endpoints

Detection Strategies

Inspect web server access logs for authenticated requests to WP User Manager AJAX or REST endpoints that include path parameters with traversal patterns
Enable WordPress file integrity monitoring to alert on deletion of core files and the plugin directory contents
Correlate subscriber-level session activity with file system change events on the underlying host

Monitoring Recommendations

Forward WordPress audit logs, web server access logs, and host file integrity events to a centralized log platform for correlation
Alert on any modification or deletion of wp-config.php regardless of source
Track new subscriber registrations followed within minutes by requests to plugin administrative endpoints

How to Mitigate CVE-2026-49766

Immediate Actions Required

Update WP User Manager to a version later than 2.9.16 once the vendor publishes a fixed release
Disable open user registration on WordPress sites running the plugin until patched, removing the subscriber prerequisite for exploitation
Audit existing subscriber accounts and remove any that were not created through legitimate workflows
Verify the integrity of wp-config.php and core WordPress files, and restore from backup if tampering is detected

Patch Information

Review the Patchstack Vulnerability Report for the latest patched version and vendor remediation guidance. Apply the fixed plugin release through the WordPress plugin manager as soon as it is available.

Workarounds

Deactivate the WP User Manager plugin until a patched release is installed
Restrict file system permissions so that the web server user cannot delete wp-config.php or files outside the WordPress uploads directory
Deploy a web application firewall rule that blocks requests containing path traversal sequences targeting WP User Manager endpoints

bash

# Example WAF rule (ModSecurity) blocking traversal in WP User Manager requests
SecRule REQUEST_URI "@contains /wp-admin/admin-ajax.php" \
  "chain,phase:2,deny,status:403,id:1026497660,msg:'WP User Manager path traversal attempt'"
SecRule ARGS "@rx (\.\./|%2e%2e%2f|%2e%2e/)" "t:none,t:lowercase"