CVE Database /
CVE-2026-49766
CVE · Critical
CVE-2026-49766 — WP User Manager – User Profile Builder & Membership [wp-user-manager] < 2.9.17
| CVE |
Vulnerability |
Type |
Severity |
Affected |
Fixed in |
Published |
Status |
|
CVE-2026-49766
|
WP User Manager – User Profile Builder & Membership [wp-user-manager] < 2.9.17 |
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') |
Critical
9.9
|
< 2.9.17
|
2.9.17 |
2026-06-05 |
—
|
CVE-2026-49766
The WP User Manager plugin for WordPress contains a critical security flaw that allows authorized users with Subscriber-level permissions or higher to erase any server file without restriction. This oversight in file path verification affects all versions of the plugin up to and including 2.9.16, making it possible for attackers to exploit this vulnerability by deleting specific files, such as the wp-config.php configuration file, which can lead to remote code execution.
Based on public CVE data (MITRE/NVD).
Scan your WordPress site free
No signup, no credit card — enter your URL and get a security report in seconds.
See the full security page for this plugin
Browse the CVE database
Browse all security findings