CVE-2026-9290: WP User Manager Plugin RCE Vulnerability

CVE-2026-9290 Overview

CVE-2026-9290 is a Local File Inclusion (LFI) vulnerability in the WP User Manager – User Profile Builder & Membership plugin for WordPress. The flaw affects all versions up to and including 2.9.17 and resides in the profile template scope function. Unauthenticated attackers can include and execute arbitrary .php files on the server, leading to arbitrary PHP code execution. Successful exploitation enables access control bypass, sensitive data disclosure, and full code execution when attackers can upload .php files through other means. The weakness is classified as CWE-22 Improper Limitation of a Pathname to a Restricted Directory.

Critical Impact

Unauthenticated remote attackers can include arbitrary local PHP files, leading to code execution and full site compromise on vulnerable WordPress installations.

Affected Products

• WP User Manager – User Profile Builder & Membership plugin for WordPress
• All versions up to and including 2.9.17
• WordPress sites with the plugin active and unpatched

Discovery Timeline

• 2026-06-06 - CVE-2026-9290 published to NVD
• 2026-06-08 - Last updated in NVD database

Technical Details for CVE-2026-9290

Vulnerability Analysis

The vulnerability is a Local File Inclusion flaw within the profile template scope handling in WP User Manager. Attacker-controlled input flows into a template inclusion path without adequate validation or normalization. The plugin's routing and template loader components, including Cortex/Router/Router.php and class-gamajo-template-loader.php, resolve user-influenced values that are then used to include PHP files from the server filesystem.

Because the affected code path is reachable without authentication, any unauthenticated visitor can trigger inclusion of .php files. When combined with any primitive that places attacker content on disk (uploads, log poisoning, session files), the LFI converts directly into remote code execution. The Exploit Prediction Scoring System places this issue in a relatively high exploitation likelihood band, consistent with how trivial LFIs in popular WordPress plugins are typically weaponized.

Root Cause

The root cause is insufficient validation of a path component used by the profile template routing logic. The plugin trusts a value derived from the request when constructing a template path, allowing path traversal sequences and arbitrary basename selection to escape the intended template directory. The vulnerable code paths are documented in WordPress Functions File, WordPress Permalinks File, and WordPress Profile Template.

Attack Vector

The attack vector is network-based and requires no authentication or user interaction. An attacker sends a crafted HTTP request to the profile route exposed by the plugin, supplying a template-scope value that resolves to an arbitrary .php file path on the server. The PHP interpreter then executes the included file in the context of the WordPress process.

The vulnerability manifests in the profile template scope function. See the Wordfence Threat Intelligence entry and the upstream GitHub Pull Request for technical details on the affected code path and remediation.

Detection Methods for CVE-2026-9290

Indicators of Compromise

• Unexpected HTTP requests targeting WP User Manager profile URLs containing path traversal sequences such as ../ or absolute filesystem paths.
• Web server access logs showing requests to profile endpoints followed by unusual PHP errors or warnings referencing include() or require().
• New or modified PHP files inside wp-content/uploads/ or other writable directories shortly after suspicious profile-route traffic.
• Outbound network connections from the PHP worker process to unfamiliar hosts after profile page requests.

Detection Strategies

• Inspect WordPress and web server logs for requests to WP User Manager profile routes containing suspicious characters, encoded traversal sequences, or .php suffixes pointing outside the plugin template directory.
• Deploy a Web Application Firewall (WAF) rule that blocks path traversal patterns and non-template file references on WP User Manager endpoints.
• Run file integrity monitoring on the WordPress installation to alert on unexpected PHP file creation or modification.

Monitoring Recommendations

• Alert on PHP processes spawning shell, network, or scripting child processes following web requests to plugin endpoints.
• Monitor for anomalous template inclusion errors in PHP error logs that reference files outside the plugin's templates/ directory.
• Track plugin version inventory across managed WordPress hosts to identify systems still running 2.9.17 or earlier.

How to Mitigate CVE-2026-9290

Immediate Actions Required

• Update WP User Manager to a version newer than 2.9.17 containing the fix referenced in the upstream GitHub Pull Request and WordPress Changeset.
• Audit web server and WordPress logs for prior exploitation attempts against profile routes since the plugin was installed.
• Restrict write permissions on wp-content/uploads/ and disable PHP execution within upload directories to break LFI-to-RCE chains.
• Rotate WordPress secrets, administrator credentials, and any database credentials if exploitation is suspected.

Patch Information

The vendor addressed the issue after version 2.9.17. Apply the patched plugin release distributed through the WordPress plugin repository. Reference the upstream fix in the GitHub Pull Request and the corresponding WordPress Changeset for the diff that constrains template path resolution.

Workarounds

• Deactivate the WP User Manager plugin until the patched version is deployed.
• Configure a WAF rule that rejects requests to WP User Manager profile routes containing ../, null bytes, or absolute path indicators.
• Disable PHP execution in any directory that accepts file uploads to prevent LFI from escalating to code execution.
• Restrict access to WordPress profile routes by IP allowlist where feasible during the remediation window.

# Example Apache hardening: block PHP execution inside uploads
<Directory "/var/www/html/wp-content/uploads">
    <FilesMatch "\.(php|phtml|phar)$">
        Require all denied
    </FilesMatch>
</Directory>

# Example ModSecurity rule to block traversal on plugin endpoints
SecRule REQUEST_URI "@contains /wp-user-manager" \
    "chain,deny,status:403,id:1009290,msg:'CVE-2026-9290 LFI attempt'"
    SecRule ARGS|REQUEST_URI "@rx (\.\./|%2e%2e/|\.php($|\?))" "t:lowercase,t:urlDecodeUni"