CVE-2026-9290

HIGH NUCLEI

WP User Manager <= 2.9.17 - Unauthenticated Path Traversal to Local File Inclusion via 'tab' Query Parameter

Title source: cna

Exploitation Summary

EIP tracks 1 public exploit for CVE-2026-9290. PoCs published by shinthink. A Nuclei detection template is also available.

AI-analyzed exploit summary This repository contains a functional exploit for CVE-2026-9290, a pre-authentication Local File Inclusion (LFI) vulnerability in WP User Manager WordPress plugin (≤ 2.9.17). The exploit leverages an unsanitized 'tab' parameter to perform path traversal and include arbitrary files, with potential for RCE via log poisoning or file uploads.

Description

The WP User Manager – User Profile Builder & Membership plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.9.17 via the (profile template scope) function. This makes it possible for unauthenticated attackers to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where .php file types can be uploaded and included.

Exploits (1)

github WORKING POC

by shinthink · pythonpoc

https://github.com/shinthink/CVE-2026-9290

View Code ZIP pw:eip

This repository contains a functional exploit for CVE-2026-9290, a pre-authentication Local File Inclusion (LFI) vulnerability in WP User Manager WordPress plugin (≤ 2.9.17). The exploit leverages an unsanitized 'tab' parameter to perform path traversal and include arbitrary files, with potential for RCE via log poisoning or file uploads.

Classification

Working Poc 98%

Attack Type

Lfi

Complexity

Moderate

Reliability

Reliable

Target: WP User Manager WordPress plugin ≤ 2.9.17

No auth needed

Prerequisites: WP User Manager plugin installed (≤ 2.9.17) · Accessible profile page endpoint · Target server running PHP

MITRE ATT&CK