shinthink/CVE-2026-9290

GitHubRepository PoCScanner

PoC files

4 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

GitHub
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

The artifact is a Python-based scanner that detects the presence of the WP User Manager plugin and tests for CVE-2026-9290, a Local File Inclusion vulnerability. It probes targets by sending HTTP requests with path traversal payloads in the 'tab' parameter and analyzes responses for markers of successful file inclusion, such as PHP errors or database credential strings. It does not execute arbitrary code or establish a shell; it only reads and reports exposed file content.

Backdoor review

No backdoor observed in reviewed code

The repository contains a Python-based proof-of-concept exploit for CVE-2026-9290, a Local File Inclusion vulnerability in the WP User Manager WordPress plugin. The code performs HTTP requests to detect the plugin, find profile pages, and test LFI by including files via the 'tab' parameter. No backdoor, concealed operator-directed harm, persistence, credential exfiltration to an external party, or unrelated payload was observed. The exploit's behavior is consistent with its stated purpose of demonstrating and testing the vulnerability.

ClassificationScanner
Model confidence95%
AuthenticationNot required
LanguagesPython
Target softwareWP User Manager – User Profile Builder & Membership (WordPress plugin)
Attack typesLocal File InclusionPath Traversal
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The code's primary operation is to detect the presence of the vulnerable plugin and test for the LFI vulnerability by sending probes and analyzing responses. It does not contain logic to execute arbitrary commands, establish a reverse shell, or perform any post-exploitation actions. The README describes an 'RCE Chain' but the scanner only checks for the accessibility of files that could be used in such a chain; it does not implement the chain itself. The artifact is therefore a scanner.

cve_2026_9290.py:140-193cve_2026_9290.py:257-265README.md:176-182

Requirements

  • Target must be running a vulnerable version (<= 2.9.17) of the WP User Manager WordPress plugin.README.md:15
  • The target's profile page must be accessible and process the 'tab' query parameter.cve_2026_9290.py:110-136

Observed behavior

  • Detects the WP User Manager plugin by requesting known plugin file paths and checking for specific markers in the response.cve_2026_9290.py:94-108
  • Identifies the profile page endpoint by testing a list of common paths and searching for WPUM profile markers in the HTML.cve_2026_9290.py:110-136
  • Tests for LFI by sending requests with path traversal payloads (e.g., '../../../wp-config.php') in the 'tab' parameter and comparing the response length and content to a baseline request.cve_2026_9290.py:140-193
  • Confirms LFI by checking the response for PHP error messages or the presence of expected file content markers like 'DB_NAME'.cve_2026_9290.py:172-188
  • Checks for potential Remote Code Execution chains by probing for accessible log files or uploaded PHP shells.cve_2026_9290.py:257-265
  • Outputs a summary of findings, including whether WPUM was detected, LFI was confirmed, and if RCE might be possible.cve_2026_9290.py:317-329
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Exploit Behavior
HTTP requests to target hosts to detect WP User Manager plugin and test Local File Inclusion via 'tab' parameterThe Python script sends GET requests to target WordPress sites, checks for plugin markers, and attempts to include files like wp-config.php and /etc/passwd. This is standard PoC behavior for the described CVE.cve_2026_9290.py:94-108cve_2026_9290.py:140-193
Network Communication
Requests to target hosts over HTTP/HTTPS with random User-Agent headersThe script uses the requests library to interact with target servers. No connections to attacker-controlled infrastructure are made; all requests are directed at the user-supplied targets.cve_2026_9290.py:86-90cve_2026_9290.py:150-164
File Operations
Reads target list from file and writes results to output fileThe script reads a list of targets from a user-specified file and optionally saves LFI results to an output file. These are local file operations controlled by the user, not unauthorized data exfiltration.cve_2026_9290.py:331-339cve_2026_9290.py:359-362
Review boundaries

What the analysis did not establish

  • One file (unclassified, 70 bytes) was omitted from the evidence and not analyzed, but it is unlikely to change the classification given the complete text of the main Python script and README.
  • The evidence does not include the execution output of the script, so the analysis is based solely on static code review.
  • One file in the repository (total 4 files, 3 with text content) was not included in the text evidence; its metadata was reported but content was not analyzed. The file is not flagged as binary and is unlikely to contain executable backdoor logic, but its absence is a minor evidence gap.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Linked vulnerabilities

1