Quick Look: CVE-2026-9290 Unauthenticated Local File Inclusion in WP User Manager WordPress Plugin

Introduction

An unauthenticated Local File Inclusion vulnerability in the WP User Manager WordPress plugin lets any remote attacker traverse directories and include arbitrary PHP files on the server, with no login required. The plugin is used on over 30,000 websites, and the attack needs nothing more than a crafted HTTP request, so this flaw is a meaningful risk to a broad swath of WordPress deployments.

WP User Manager is a WordPress plugin for customizable user profiles, registration forms, login pages, password recovery, and membership functionality. It has been available on WordPress.org since 2015 and is developed by Iain Poulson, a WordPress developer with over 12 years of experience. Many WordPress sites need frontend profile editing and membership features, and the plugin extends WordPress's native user management to provide them.

Technical Information

CVE-2026-9290 is classified under CWE-22 (Improper Limitation of a Pathname to a Restricted Directory) and has a CVSS v3.1 score of 7.5 with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. That vector describes an attack over the network with low complexity, no authentication, no user interaction, and high confidentiality impact.

Root Cause

The flaw starts in wpum_get_active_profile_tab(), in includes/functions.php at line 955. The function reads the tab query parameter straight from the URL and never checks it against the set of registered profile tabs. The unsanitized value then passes through several layers of the plugin's template-loading pipeline until it reaches a file inclusion operation.

The Vulnerable Code Path

The tainted tab value moves through five source files, and none of them sanitize it:

1. includes/functions.php (line 955): wpum_get_active_profile_tab() reads the tab query variable from the request and does not check it against the registered tabs.

2. includes/permalinks.php (line 133): The routing and rewrite logic processes the tab value during URL resolution.

3. templates/profile.php (line 52): The profile template uses the unvalidated tab value to decide which template partial to load.

4. vendor-dist/gamajo/template-loader/class-gamajo-template-loader.php (line 226): The Gamajo Template Loader class builds a template path that includes the attacker-controlled tab value.

5. vendor-dist/brain/cortex/src/Cortex/Router/Router.php (line 183): The Cortex router handles URL routing and passes the tab parameter through without restriction.

Attack Flow

An attacker exploits this vulnerability in four steps:

1. Identify a target: The attacker finds a WordPress site running WP User Manager version 2.9.17 or earlier. Automated scanning of WordPress installations can turn these up by checking for the plugin's characteristic profile page endpoints.

2. Craft a malicious request: The attacker sends an HTTP request to the site's profile page with a tab query parameter that contains path traversal sequences (e.g., ../). wpum_get_active_profile_tab() accepts any user-supplied value, so the traversal sequences go directly into the template-loading pipeline.

3. File inclusion occurs: The Gamajo Template Loader builds a file path from the attacker-controlled tab value. The traversal sequences make the loader resolve to a file outside the intended template directory, and the PHP include operation executes that file.

4. Data exfiltration or code execution: If the included file is a configuration file like wp-config.php, the attacker gets the database credentials and authentication keys. If the site allows .php file uploads through any other plugin or WordPress feature, the attacker can upload a malicious PHP file first and then use the LFI to include and execute it, which gives full remote code execution.

CVSS Nuance

The CVSS base score of 7.5 rates integrity and availability impact as "None," which fits the LFI scenario taken on its own. The vulnerability description, however, says outright that code execution is possible when .php files can be uploaded and included. On a site with any file upload functionality, the combined risk is higher than the base CVSS score conveys.

Affected Systems and Versions

The vulnerability affects the WP User Manager plugin for WordPress in all versions up to and including 2.9.17. The source code references in the CVE advisory point to tags 2.9.15 and 2.9.17, which confirms the vulnerable code was present in multiple releases.

Any WordPress installation with WP User Manager version 2.9.17 or earlier activated is vulnerable. The attack surface is the profile page endpoint, which is typically publicly accessible.

Vendor Security History

WP User Manager had at least two disclosed vulnerabilities before CVE-2026-9290:

In each case, user-controlled input reached a sensitive operation without enough validation. The CSRF issue came from missing nonce validation, the file deletion from inadequate access controls, and CVE-2026-9290 from the lack of an allowlist check on the tab parameter. The vendor has been responsive in patching reported issues, but the progression from lower-severity to high-severity flaws suggests that a proactive security audit of every input handling path would work better than the current reactive approach.

The vendor's response to CVE-2026-9290 was thorough. The fix PR adds allowlist validation along with 8 WPUnit tests that check behavior against valid tabs, directory traversal attempts, null byte sequences, and unregistered tab values.

References

• Wordfence Threat Intelligence Advisory for CVE-2026-9290
• GitHub Pull Request #445: Security fix for profile and account tab input validation
• WordPress Plugin Repository Changeset 3554574
• Vulnerable source: functions.php line 955 (tag 2.9.17)
• Vulnerable source: permalinks.php line 133 (tag 2.9.17)
• Vulnerable source: profile.php line 52 (tag 2.9.17)
• Vulnerable source: class-gamajo-template-loader.php line 226 (tag 2.9.17)
• Vulnerable source: Router.php line 183 (tag 2.9.17)
• WP User Manager on WordPress.org
• WP User Manager About Page
• GitHub Advisory GHSA-3h64-fx5v-2f3q
• Patchstack: CSRF in WP User Manager <= 2.9.10
• WPScan: WP User Manager < 2.9.11 CSRF
• CISA Known Exploited Vulnerabilities Catalog
• Wordfence: How to Find LFI Vulnerabilities in WordPress Plugins