CVE-2026-16289
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk6th percentile - higher than 6% of all known CVEs
Summary
The 'ProfileGrid' WordPress plugin before version 6.0.0.0 does not perform authorization checks when listing a group's pending membership requests, allowing any authenticated user such as a Subscriber to disclose the names and request dates of the users awaiting approval to join any group, including private ones.
Risk Assessment
Users can access sensitive information about other users, such as their names and request dates to join private groups.
Recommendation
Update the plugin to version 6.0.0.0 or later, which adds proper authorization checks.
Other vulnerabilities in ProfileGrid
See all- CVE-2026-12073Critical
The ProfileGrid plugin for WordPress up to version 5.9.9.5 contains a privilege escalation vulnerability via account takeover. Lack of validation of the `user_login` parameter in registration forms and improper error handling allow unauthenticated attackers to change the email address of the user account with ID=1 (typically an administrator), then reset the password and gain access.
- CVE-2026-16291Medium
The ProfileGrid WordPress plugin before version 5.9.9.8 does not verify that a notification belongs to the requesting user before deleting it. Any authenticated user (e.g., Subscriber) can delete other users' notifications by enumerating notification identifiers.
- CVE-2026-12687High
The ProfileGrid WordPress plugin before 5.9.9.8 does not restrict which group an anonymous visitor may register into through its front-end registration. Unauthenticated users can register directly into a privileged group and be granted that group's configured role, up to Administrator, leading to privilege escalation.
- CVE-2026-12690Low
The ProfileGrid WordPress plugin before version 5.9.9.7 does not perform a capability check on its license management actions, relying only on a nonce that is exposed to any logged-in user, allowing authenticated users with Subscriber-level access and above to overwrite the site's premium license settings.
- CVE-2026-12689Medium
The ProfileGrid WordPress plugin before version 5.9.9.7 does not perform any authorization or ownership check on some of its private-message thread actions, allowing authenticated users with Subscriber-level access and above to soft-delete, tamper with the metadata of, and mark as read other users' private message threads.
- CVE-2026-12688Medium
The ProfileGrid WordPress plugin before version 5.9.9.7 does not verify PayPal IPN notifications before granting paid group membership, allowing unauthenticated attackers to forge a payment notification and mark any user as a paid member of any group without any payment.
- CVE-2026-57697High
The ProfileGrid plugin for WordPress contains an authentication bypass vulnerability via an alternate path or channel, allowing password recovery exploitation. This affects versions up to and including 5.9.9.6.
- CVE-2026-57759High
The ProfileGrid plugin version 5.9.9.7 and earlier contains an unauthenticated Cross-Site Request Forgery (CSRF) vulnerability. An attacker can trick a logged-in administrator into performing unintended actions without their knowledge.
- CVE-2026-4610Medium
The ProfileGrid plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'pm_author_message' parameter in the pm_send_message_to_author function in all versions up to 5.9.9.2 due to insufficient input sanitization and output escaping.
Original NVD description (English source)
The ProfileGrid WordPress plugin before 6.0.0.0 does not perform authorization checks when listing a group's pending membership requests, allowing any authenticated user such as a Subscriber to disclose the names and request dates of the users awaiting approval to join any group, including private ones.