CVE-2026-12687
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk4th percentile - higher than 4% of all known CVEs
Summary
The ProfileGrid WordPress plugin before 5.9.9.8 does not restrict which group an anonymous visitor may register into through its front-end registration. Unauthenticated users can register directly into a privileged group and be granted that group's configured role, up to Administrator, leading to privilege escalation.
Risk Assessment
An attacker can gain unauthorized administrative access to the site, taking full control over it.
Recommendation
Update the ProfileGrid plugin to version 5.9.9.8 or later.
Other vulnerabilities in ProfileGrid
See all- CVE-2026-12073Critical
The ProfileGrid plugin for WordPress up to version 5.9.9.5 contains a privilege escalation vulnerability via account takeover. Lack of validation of the `user_login` parameter in registration forms and improper error handling allow unauthenticated attackers to change the email address of the user account with ID=1 (typically an administrator), then reset the password and gain access.
- CVE-2026-16289Medium
The 'ProfileGrid' WordPress plugin before version 6.0.0.0 does not perform authorization checks when listing a group's pending membership requests, allowing any authenticated user such as a Subscriber to disclose the names and request dates of the users awaiting approval to join any group, including private ones.
- CVE-2026-16291Medium
The ProfileGrid WordPress plugin before version 5.9.9.8 does not verify that a notification belongs to the requesting user before deleting it. Any authenticated user (e.g., Subscriber) can delete other users' notifications by enumerating notification identifiers.
- CVE-2026-12690Low
The ProfileGrid WordPress plugin before version 5.9.9.7 does not perform a capability check on its license management actions, relying only on a nonce that is exposed to any logged-in user, allowing authenticated users with Subscriber-level access and above to overwrite the site's premium license settings.
- CVE-2026-12689Medium
The ProfileGrid WordPress plugin before version 5.9.9.7 does not perform any authorization or ownership check on some of its private-message thread actions, allowing authenticated users with Subscriber-level access and above to soft-delete, tamper with the metadata of, and mark as read other users' private message threads.
- CVE-2026-12688Medium
The ProfileGrid WordPress plugin before version 5.9.9.7 does not verify PayPal IPN notifications before granting paid group membership, allowing unauthenticated attackers to forge a payment notification and mark any user as a paid member of any group without any payment.
- CVE-2026-57697High
The ProfileGrid plugin for WordPress contains an authentication bypass vulnerability via an alternate path or channel, allowing password recovery exploitation. This affects versions up to and including 5.9.9.6.
- CVE-2026-57759High
The ProfileGrid plugin version 5.9.9.7 and earlier contains an unauthenticated Cross-Site Request Forgery (CSRF) vulnerability. An attacker can trick a logged-in administrator into performing unintended actions without their knowledge.
- CVE-2026-4610Medium
The ProfileGrid plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'pm_author_message' parameter in the pm_send_message_to_author function in all versions up to 5.9.9.2 due to insufficient input sanitization and output escaping.
Original NVD description (English source)
The ProfileGrid WordPress plugin before 5.9.9.8 does not restrict which group an anonymous visitor may register into through its front-end registration, allowing unauthenticated users to register directly into a privileged group and be granted that group's configured role, up to Administrator when such a group exists, leading to privilege escalation.