CVE-2026-9290

Name of the Vulnerable Software and Affected Versions WP User Manager – User Profile Builder & Membership versions prior to 2.9.18

Description The plugin is susceptible to Local File Inclusion, a condition where an application includes files on a local server unexpectedly. This occurs through the profile template scope function, allowing unauthenticated attackers to include and execute arbitrary .php files. This can lead to the execution of PHP code, bypassing of access controls, or the acquisition of sensitive data, particularly when .php files can be uploaded to the server.

Recommendations Update the plugin to version 2.9.18 or later. As a temporary workaround, restrict access to the profile template scope function to minimize the risk of exploitation.