# CVE-2026-9290: WP User Manager Local File Inclusion in profile template scope

Source: https://junglewise.ai/threats/cve-2026-9290-wp-user-manager-local-file-inclusion-in-profile-template-scope  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-06. Updated: 2026-06-06  
License: CC BY 4.0 with a link back

CVE-2026-9290 · Severity: high · CVSS 7.5 · Published 2026-06-06

WP User Manager, a popular WordPress plugin used for creating member profiles and registration forms, contains a security flaw that allows unauthorized individuals to access internal server files. By exploiting this vulnerability, an attacker could potentially view sensitive data or execute malicious code if they are able to upload a file to the server. This could lead to a full compromise of the website and its user data.

Technologies: [WP User Manager – User Profile Builder & Membership](https://junglewise.ai/threats/technologies/wp-user-manager). Vendors: [WP User Manager](https://junglewise.ai/threats/vendors/wp-user-manager).

## Quick answers

**Is CVE-2026-9290 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-9290 being exploited in the wild.

**How severe is CVE-2026-9290?** High severity, with a CVSS score of 7.5, published 6 June 2026.

**Which products and versions are affected?** WP User Manager – User Profile Builder & Membership Up to and including 2.9.17.

**Is there a fix for CVE-2026-9290?** A patch was published on 2026-05-30: Pull request with security fix merged on GitHub Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-9290 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-9290?** Check whether you run WP User Manager – User Profile Builder & Membership at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The WP User Manager plugin for WordPress is vulnerable to Local File Inclusion (LFI) via the profile template scope function in all versions up to and including 2.9.17. The root cause is a failure to validate the 'tab' query variable against a whitelist of registered tabs before using it in template loading functions like wpum_get_active_profile_tab(). An unauthenticated remote attacker can exploit this by supplying a path to a local PHP file, which the server will then include and execute. This can lead to sensitive information disclosure or remote code execution if the attacker can pair this with a file upload vulnerability. A patch has been developed to validate input against registered profile and account tabs.

## Affected products

- WP User Manager WP User Manager – User Profile Builder & Membership Up to and including 2.9.17

## Timeline

- 2026-05-30: patched: Pull request with security fix merged on GitHub
- 2026-06-06: disclosed: CVE published to NVD dataset

## References

- [https://github.com/WPUserManager/wp-user-manager/pull/445](https://github.com/WPUserManager/wp-user-manager/pull/445)
- [https://plugins.trac.wordpress.org/browser/wp-user-manager/tags/2.9.15/includes/functions.php](https://plugins.trac.wordpress.org/browser/wp-user-manager/tags/2.9.15/includes/functions.php)
- [https://plugins.trac.wordpress.org/browser/wp-user-manager/tags/2.9.15/includes/permalinks.php](https://plugins.trac.wordpress.org/browser/wp-user-manager/tags/2.9.15/includes/permalinks.php)
- [https://plugins.trac.wordpress.org/browser/wp-user-manager/tags/2.9.15/templates/profile.php](https://plugins.trac.wordpress.org/browser/wp-user-manager/tags/2.9.15/templates/profile.php)
- [https://plugins.trac.wordpress.org/browser/wp-user-manager/tags/2.9.15/vendor-dist/brain/cortex/src/Cortex/Router/Router.php](https://plugins.trac.wordpress.org/browser/wp-user-manager/tags/2.9.15/vendor-dist/brain/cortex/src/Cortex/Router/Router.php)
- [https://plugins.trac.wordpress.org/browser/wp-user-manager/tags/2.9.15/vendor-dist/gamajo/template-loader/class-gamajo-template-loader.php](https://plugins.trac.wordpress.org/browser/wp-user-manager/tags/2.9.15/vendor-dist/gamajo/template-loader/class-gamajo-template-loader.php)
- [https://plugins.trac.wordpress.org/browser/wp-user-manager/tags/2.9.17/includes/functions.php](https://plugins.trac.wordpress.org/browser/wp-user-manager/tags/2.9.17/includes/functions.php)