PT-2026-23816 · WordPress · Profilegrid – User Profiles

Boris Bogosavac + 1 · Publicado 2026-03-07 · Atualizado 2026-03-07 · CVE-2026-2488

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Média

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions ProfileGrid – User Profiles, Groups and Communities plugin for WordPress versions up to and including 5.9.8.1

Description The ProfileGrid plugin for WordPress is affected by an issue allowing unauthorized message deletion. This occurs because the pg delete msg() function lacks a proper capability check, enabling authenticated attackers with Subscriber-level access or higher to delete messages belonging to any user. Exploitation involves sending a direct request with a valid message ID through the mid parameter.

Recommendations Update ProfileGrid – User Profiles, Groups and Communities plugin for WordPress to a version later than 5.9.8.1.

Correção

Missing Authorization

Enumeração de Fraquezas

CWE-862

Identificadores relacionados

CVE-2026-2488

Produtos afetados

Profilegrid – User Profiles

Referências · 10

• https://twitter.com/CVEnew/status/2030339370025357805 · Publicação no Twitter
• https://plugins.trac.wordpress.org/browser/profilegrid-user-profiles-groups-and-communities/tags/5.9.7.1/public/class-profile-magic-public.php#L5913 · Nota
• https://wordfence.com/threat-intel/vulnerabilities/id/4c611fa0-28ef-4425-8614-fb61e250e625?source=cve · Nota
• https://plugins.trac.wordpress.org/browser/profilegrid-user-profiles-groups-and-communities/trunk/public/class-profile-magic-public.php#L5913 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-2488 · Nota de Segurança
• https://t.me/CVEtracker/46680 · Publicação no Telegram
• https://plugins.trac.wordpress.org/browser/profilegrid-user-profiles-groups-and-communities/trunk/includes/class-profile-magic.php#L372 · Nota
• https://plugins.trac.wordpress.org/browser/profilegrid-user-profiles-groups-and-communities/tags/5.9.7.1/includes/class-profile-magic.php#L372 · Nota
• https://twitter.com/infoflowcloud/status/2030340465489231959 · Publicação no Twitter
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3464213%40profilegrid-user-profiles-groups-and-communities&new=3464213%40profilegrid-user-profiles-groups-and-communities&sfp_email=&sfph_mail= · Nota