PT-2026-23816 · WordPress · Profilegrid – User Profiles

Boris Bogosavac + 1 · Published 2026-03-07 · Updated 2026-03-07 · CVE-2026-2488

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions ProfileGrid – User Profiles, Groups and Communities plugin for WordPress versions up to and including 5.9.8.1

Description The ProfileGrid plugin for WordPress is affected by an issue allowing unauthorized message deletion. This occurs because the pg delete msg() function lacks a proper capability check, enabling authenticated attackers with Subscriber-level access or higher to delete messages belonging to any user. Exploitation involves sending a direct request with a valid message ID through the mid parameter.

Recommendations Update ProfileGrid – User Profiles, Groups and Communities plugin for WordPress to a version later than 5.9.8.1.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2026-2488

Affected Products

Profilegrid – User Profiles

References · 10

• https://nvd.nist.gov/vuln/detail/CVE-2026-2488 · Security Note
• https://twitter.com/CVEnew/status/2030339370025357805 · Twitter Post
• https://plugins.trac.wordpress.org/browser/profilegrid-user-profiles-groups-and-communities/tags/5.9.7.1/public/class-profile-magic-public.php#L5913 · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/4c611fa0-28ef-4425-8614-fb61e250e625?source=cve · Note
• https://plugins.trac.wordpress.org/browser/profilegrid-user-profiles-groups-and-communities/trunk/public/class-profile-magic-public.php#L5913 · Note
• https://t.me/CVEtracker/46680 · Telegram Post
• https://plugins.trac.wordpress.org/browser/profilegrid-user-profiles-groups-and-communities/trunk/includes/class-profile-magic.php#L372 · Note
• https://plugins.trac.wordpress.org/browser/profilegrid-user-profiles-groups-and-communities/tags/5.9.7.1/includes/class-profile-magic.php#L372 · Note
• https://twitter.com/infoflowcloud/status/2030340465489231959 · Twitter Post
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3464213%40profilegrid-user-profiles-groups-and-communities&new=3464213%40profilegrid-user-profiles-groups-and-communities&sfp_email=&sfph_mail= · Note