CVE-2026-9290: WP User Manager <= 2.9.17 - Unauthenticated Path Traversal to Local File Inclusion via 'tab' Query Parameter

Synopsis

Local File Inclusion (LFI) via path traversal in the WP User Manager plugin for WordPress (versions up to and including 2.9.17) allows an unauthenticated remote attacker to include and execute arbitrary PHP files on the server through the 'tab' query parameter. The vulnerability is reachable over the network with no credentials required and no victim interaction needed. Successful exploitation enables an attacker to read sensitive data, bypass access controls, or achieve remote code execution if a PHP file can be uploaded to the server. No upstream fix has been published; HarborGuard tracks the advisory for patch availability.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable endpoint is exposed over the network; an attacker must be able to send HTTP requests to the WordPress instance.

• AuthenticationNot required

  No account or credentials of any kind are needed to trigger the path traversal and file inclusion.

• Victim interactionNot required

  The attacker can exploit this vulnerability autonomously without any action from a user or administrator.

• Attack complexityDetail

  Exploit conditions are straightforward and reliable; no race conditions or special environmental factors need to be satisfied.

Blast Radius

• An attacker can read arbitrary PHP files on the server, including configuration files that contain database credentials and secret keys.
• If the attacker can upload a PHP file anywhere on the server (via any upload mechanism), they can include and execute it, achieving full remote code execution.
• Execution of included PHP files can be used to create or modify WordPress administrator accounts, bypassing all access controls.
• Sensitive data such as stored user records, hashed passwords, and API tokens held in the database or on the filesystem becomes readable.