What the vulnerability does
01Description
The WP User Manager – User Profile Builder & Membership plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.9.17 via the (profile template scope) function. This makes it possible for unauthenticated attackers to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where .php file types can be uploaded and included.
Explanation of Vulnerability in Simple Terms
02Summary
WP User Manager versions up to 2.9.17 contain a path traversal vulnerability that allows unauthenticated attackers to read arbitrary files from the server. An attacker can access sensitive files such as configuration files, database credentials, or other private data by manipulating file paths. No user interaction is required. Update to a version newer than 2.9.17 to resolve this issue.
What an attacker can do
03Attacker Capabilities
Read arbitrary files from your server, including configuration and credential files.
Potential impact on your site
04Site Impact
Sensitive files like wp-config.php and database credentials could be exposed to attackers.
Conditions required to exploit
05Prerequisites
Network access only; no authentication or user interaction required.
Key dates
06Disclosure timeline
June 5, 2026
CVE published
June 6, 2026
Record updated
