CVE-2026-9290: WP User Manager Unauthenticated Path Traversal to LFI (CVSS 7.5)

CVE-2026-9290 (CVSS 7.5): Unauthenticated Path Traversal to LFI in WP User Manager <= 2.9.17 via the unvalidated 'tab' query parameter.