PT-2026-40611 · WordPress · Profilegrid

Jonah Burgess · Published 2026-05-13 · Updated 2026-05-13 · CVE-2026-4609

Positive Technologies (AI Summary)

CVSS v3.1

7.1

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N

Name of the Vulnerable Software and Affected Versions ProfileGrid – User Profiles, Groups and Communities versions prior to 5.9.8.5

Description The ProfileGrid – User Profiles, Groups and Communities plugin for WordPress allows unauthorized access because the pm invite user() function lacks a capability check. Authenticated attackers with Subscriber-level access or higher can exploit this to add themselves or other registered users to any group, including closed and paid groups, effectively bypassing authorization and payment gates.

Recommendations Update the plugin to a version later than 5.9.8.4. As a temporary workaround, restrict access to the pm invite user() function to minimize the risk of exploitation.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2026-4609

Affected Products

Profilegrid

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2026-4609 · Security Note
• https://wordfence.com/threat-intel/vulnerabilities/id/c3678b4d-0cd0-4873-8cf3-90c557931f4c?source=cve · Note
• https://twitter.com/VulmonFeeds/status/2054599207877488836 · Twitter Post
• https://plugins.trac.wordpress.org/changeset/3491679 · Note
• https://plugins.trac.wordpress.org/browser/profilegrid-user-profiles-groups-and-communities/trunk/public/class-profile-magic-public.php#L3319 · Note
• https://twitter.com/KaitanSecurity/status/2054600121271111700 · Twitter Post
• https://plugins.trac.wordpress.org/browser/profilegrid-user-profiles-groups-and-communities/trunk/public/class-profile-magic-public.php#L3280 · Note