CVE-2026-9290 is a Local File Inclusion vulnerability in the WP User Manager – User Profile Builder & Membership WordPress plugin affecting all versions up to 2.9.17. The flaw exists in the profile template scope function, which improperly limits pathname input, allowing unauthenticated attackers to include arbitrary .php files on the server. This can lead to execution of arbitrary PHP code, bypassing access controls and potentially exposing sensitive information or enabling remote code execution. The vulnerability is identified as CWE-22 (Improper Limitation of a Pathname to a Restricted Directory). The CVSS 3.1 base score is 7.5, reflecting a high severity due to network attack vector, no privileges required, and no user interaction needed.

Successful exploitation allows unauthenticated attackers to include and execute arbitrary PHP files on the affected server. This can lead to bypassing access controls, unauthorized disclosure of sensitive data, and remote code execution. The impact is significant given the ability to execute code without authentication.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling or removing the vulnerable plugin or restricting access to the affected functionality. Monitor vendor channels for updates and apply patches promptly once available.