CVE-2026-9290Disclosure

LOWCVSS 7.5 · HIGH

Exploit discussion active in current signal (1 latest mentions)

Immediate actions

Hunt for exploitation attempts and persistence artifacts
Increase monitoring for publicly documented tradecraft
Track advisory updates for patch or workaround availability

Recommended action window: High priority (within 72h)

NVD description

The WP User Manager – User Profile Builder & Membership plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.9.17 via the (profile template scope) function. This makes it possible for unauthenticated attackers to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where .php file types can be uploaded and included.

Back to dashboard

1.5/ 10 priority

Sources & remediation

Other references

Weakness type (CWE)

CWE-22

Priority

LOW

Exploitation

NONE

PoC

YES

Patch

NONE

Momentum

STABLE

Threat summary

Public PoC is present in monitored signal
4 mentions across 3 observed days
Momentum state: stable

What's happening

PoC mentioned or linked in 1 signal
Technical details provided in 4 signals
Disclosure: 3 classified signals
Peaked 2d ago at 2 mentions (2026-06-07); latest day: 1
4 total mentions across 3 days

Deep dive

Activity timeline4 mentions / 3d

Signal classification2 categories

Disclosure

375.0%

PoC

125.0%

Referenced assets4 URLs

By indicator

Classification over time

Date	Total	Labels

2026-06-07	2	Disclosure2
2026-06-11	1	Disclosure1
2026-06-14	1	PoC1

Full discourse4 posts

pdnuclei-bot@pdnuclei_bot133d
Disclosure
🚨 CVE-2026-9290 - high 🚨 WP User Manager – User Profile Builder & Membership - Local File Inclusion > WP User Manager – User Profile Builder & Membership plugin for WordPress <= 2.9.17 co... 👾 https://cloud.projectdiscovery.io/library/CVE-2026-9290 @pdnuclei #NucleiTemplat...
Post summary
The tweet announces the high‑severity CVE‑2026‑9290 affecting the WP User Manager plugin by describing it as a local file inclusion vulnerability, providing only basic technical details without any PoC, exploit, patch, or evidence of active exploitation.
00011146
958 followersView on X
Atomic Edge@atomicedgeWAF129d
PoC
https://atomicedge.io/cve-proof/cve-2026-9290-wp-user-manager-version-2-9-17-high-vulnerability-proof-of-concept CVE-2026-9290 wp-user-manager (CVSS Score 7.5) #WordPress plugin #vulnerability #cybersecurity #wordpressfirewall #wordpresssecurity #hacking #wpsecurity #atomicedg…
Post summary
The tweet links to a proof‑of‑concept for CVE‑2026‑9290 affecting the WordPress wp‑user‑manager plugin (CVSS 7.5), but it contains no active exploitation, patch, or exploit tool details.
0000042
9 followersView on X
Infoflowcloud@infoflowcloud136d
Disclosure
🚨*CVE* CVE-2026-9290 The WP User Manager – User Profile Builder & Membership plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.9.17 via the … https://www.cve.org/CVERecord?id=CVE-2026-9290 ----- Traducción: CVE-2026-9290 El … http://infoflow.cloud`
Post summary
A CVE (CVE-2026-9290) is disclosed for the WP User Manager plugin, highlighting a Local File Inclusion flaw affecting versions up to 2.9.17; no exploitation details or patch info are provided.
0000019
79 followersView on X
CVE@CVEnew136d
Disclosure
CVE-2026-9290 The WP User Manager – User Profile Builder & Membership plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.9.17 via the … https://www.cve.org/CVERecord?id=CVE-2026-9290
Post summary
The WP User Manager plugin is vulnerable to Local File Inclusion in versions up to 2.9.17; the post indicates the existence of the flaw but does not mention a PoC, exploit, active usage, or remediation.
00000188
57.6K followersView on X

Explore more

Back to dashboard

What researchers are saying

CVE-2026-9290

pdnuclei-bot@pdnuclei_botDisclosure

The tweet announces the high‑severity CVE‑2026‑9290 affecting the WP User Manager plugin by describing it as a local file inclusion vulnerability, providing only basic technical details without any PoC, exploit, patch, or evidence of active exploitation.

Atomic Edge@atomicedgeWAFPoC

The tweet links to a proof‑of‑concept for CVE‑2026‑9290 affecting the WordPress wp‑user‑manager plugin (CVSS 7.5), but it contains no active exploitation, patch, or exploit tool details.

Infoflowcloud@infoflowcloudDisclosure

A CVE (CVE-2026-9290) is disclosed for the WP User Manager plugin, highlighting a Local File Inclusion flaw affecting versions up to 2.9.17; no exploitation details or patch info are provided.

CVE@CVEnewDisclosure

The WP User Manager plugin is vulnerable to Local File Inclusion in versions up to 2.9.17; the post indicates the existence of the flaw but does not mention a PoC, exploit, active usage, or remediation.