Quick answers
- Is CVE-2026-49766 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-49766 being exploited in the wild.
- How severe is CVE-2026-49766?
- Critical severity, with a CVSS score of 9.9, published 15 June 2026.
- Which products and versions are affected?
- WP User Manager <= 2.9.16.
- Is there a fix for CVE-2026-49766?
- A patch was published on 2026-06-05: Patch released in version 2.9.17 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-49766 attacked?
- It is attacked over the network, in a network appliance.
- Am I affected by CVE-2026-49766?
- Check whether you run WP User Manager at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The WP User Manager plugin for WordPress (versions up to and including 2.9.16) is vulnerable to arbitrary file deletion due to improper path validation, classified as a path traversal issue (CWE-22). An authenticated attacker with Subscriber-level privileges can exploit this vulnerability to delete files outside of the intended directory. This is achieved by manipulating file paths in requests handled by the plugin. Deleting critical files like wp-config.php can lead to site takeover or permanent denial of service. The issue is resolved in version 2.9.17.
Affected products
- WP User Manager WP User Manager <= 2.9.16
Timeline
- 2026-04-17: other: Vulnerability reported by researcher endy
- 2026-06-05: patched: Patch released in version 2.9.17
- 2026-06-15: advisory: NVD and Patchstack advisory published