PT-2026-53809 · WordPress · Profilegrid

Ivan Kuzymchak · Published 2026-06-30 · Updated 2026-06-30 · CVE-2026-12073

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions ProfileGrid – User Profiles, Groups and Communities versions prior to 5.9.9.6

Description An issue allows unauthenticated attackers to perform privilege escalation via account takeover. The flaw exists because the plugin fails to validate the user login variable on registration forms that lack this parameter and does not properly handle error messages. This allows an attacker to change the email address of the user account with ID=1, which is typically the administrator, and subsequently reset the password to gain full access to the account.

Recommendations Update ProfileGrid – User Profiles, Groups and Communities to version 5.9.9.6 or later.

Fix

LPE

IDOR

Weakness Enumeration

CWE-639

Related Identifiers

CVE-2026-12073

Affected Products

Profilegrid

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2026-12073 · Security Note
• https://twitter.com/VulmonFeeds/status/2071853526968385812 · Twitter Post
• https://plugins.trac.wordpress.org/changeset/3578435 · Note
• https://twitter.com/OrizonCyber/status/2071843692009116101 · Twitter Post
• https://wordfence.com/threat-intel/vulnerabilities/id/2d35279d-299e-4ca2-8f84-165284e058c8?source=cve · Note