CVE-2026-49766

CriticalCVSS 9.9

Published: 15/06/2026(UTC)Updated: 15/06/2026(UTC)Translated: 16/06/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.51%

39th percentile — higher than 39% of all known CVEs

The WP User Manager plugin versions up to 2.9.16 contain a vulnerability that allows subscribers to delete arbitrary files.

An attacker could exploit this vulnerability to delete critical files, potentially leading to data loss and disruption of system functionality.

It is recommended to update the WP User Manager plugin to the latest version to mitigate this vulnerability.

Original NVD description (English source)

Subscriber Arbitrary File Deletion in WP User Manager <= 2.9.16 versions.