CVE-2026-9290 is a path traversal vulnerability (CWE-22) in the WP User Manager – User Profile Builder & Membership plugin for WordPress. The flaw exists in the profile template scope function, allowing unauthenticated attackers to perform Local File Inclusion by manipulating pathnames. This enables inclusion and execution of arbitrary PHP files on the server, potentially leading to code execution and unauthorized access to sensitive data. The vulnerability affects all versions up to and including 2.9.17.

Successful exploitation allows unauthenticated attackers to include and execute arbitrary PHP files on the server. This can result in bypassing access controls, unauthorized disclosure of sensitive information, and remote code execution. The CVSS 3.1 base score is 7.5 (high severity) with network attack vector, low attack complexity, no privileges required, no user interaction, and high confidentiality impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch has been published as of the provided data. Until a patch is available, restrict the ability to upload PHP files and monitor for suspicious activity related to the profile template scope function. Follow vendor advisories closely for updates on remediation.