PT-2026-40610 · WordPress · Profilegrid

Jonah Burgess · CVE-2026-4608 · Published 2026-05-13 · Updated 2026-05-13

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions ProfileGrid versions prior to 5.9.8.5

Description The ProfileGrid – User Profiles, Groups and Communities plugin for WordPress contains a blind SQL Injection flaw. This issue occurs due to insufficient escaping of user-supplied parameters and a lack of proper preparation of the SQL query. Authenticated attackers with Subscriber-level access or higher can append additional SQL queries via the rid parameter to extract sensitive information from the database.

Recommendations Update the plugin to a version later than 5.9.8.4. As a temporary workaround, restrict access to the rid parameter to minimize the risk of exploitation.

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2026-4608

Affected Products

Profilegrid

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2026-4608 · Security Note
• https://wordfence.com/threat-intel/vulnerabilities/id/3f58ed72-5a0b-4b43-ad76-7730c79741da?source=cve · Note
• https://plugins.trac.wordpress.org/browser/profilegrid-user-profiles-groups-and-communities/trunk/includes/class-profile-magic-dbhandler.php#L192 · Note
• https://plugins.trac.wordpress.org/changeset/3491679 · Note
• https://twitter.com/VulmonFeeds/status/2054604326782312901 · Twitter Post
• https://plugins.trac.wordpress.org/browser/profilegrid-user-profiles-groups-and-communities/trunk/includes/class-profile-magic-request.php#L2448 · Note
• https://plugins.trac.wordpress.org/browser/profilegrid-user-profiles-groups-and-communities/trunk/includes/class-profile-magic-dbhandler.php#L555 · Note
• https://plugins.trac.wordpress.org/browser/profilegrid-user-profiles-groups-and-communities/trunk/public/class-profile-magic-public.php#L4755 · Note