PT-2026-23817 · WordPress · Profilegrid – User Profiles
Boris Bogosavac
+1
·
Publicado
2026-03-07
·
Atualizado
2026-03-07
·
CVE-2026-2494
CVSS v3.1
4.3
Média
| Vetor | AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N |
Name of the Vulnerable Software and Affected Versions
ProfileGrid – User Profiles, Groups and Communities plugin for WordPress versions up to and including 5.9.8.2
Description
The ProfileGrid plugin for WordPress is susceptible to Cross-Site Request Forgery (CSRF). This is a result of a lack of nonce validation on the membership request management page, specifically during approve and decline actions. An unauthenticated attacker can potentially approve or deny group membership requests by tricking a site administrator into performing an action, such as clicking a malicious link. The affected functionality involves the processing of membership requests.
Recommendations
Update ProfileGrid – User Profiles, Groups and Communities plugin for WordPress to a version later than 5.9.8.2.
Correção
CSRF
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Profilegrid – User Profiles