ProfileGrid CVE-2025-26999
HIGHSeverity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
4DescriptionCVE.org
Deserialization of Untrusted Data vulnerability in Metagauss ProfileGrid allows Object Injection. This issue affects ProfileGrid : from n/a through 5.9.4.3.
AnalysisAI
PHP object injection in ProfileGrid WordPress plugin versions up to 5.9.4.3 allows authenticated attackers to execute arbitrary code through unsafe deserialization of user-controlled data. With CVSS 8.8 severity and only low-privilege authentication required, this CWE-502 vulnerability enables full site compromise. EPSS exploitation probability is low (0.23%, 45th percentile) and no active exploitation or public POC is confirmed, though Patchstack has documented the vulnerability in their WordPress plugin security database.
Technical ContextAI
This is a PHP object injection vulnerability (CWE-502: Deserialization of Untrusted Data) affecting the ProfileGrid WordPress plugin, a community management and user profile platform. PHP object injection occurs when untrusted serialized data is passed to the unserialize() function without proper validation. Attackers can craft malicious serialized objects that, when deserialized, trigger magic methods like __wakeup() or __destruct() in existing classes to execute arbitrary code. ProfileGrid likely deserializes user-supplied data (POST parameters, cookies, or database values) in its user profile or group management functionality without validating object types or sanitizing input. The vulnerability affects all versions through 5.9.4.3, indicating a longstanding architectural flaw in how the plugin handles serialized data structures for profile fields, group settings, or user metadata.
Affected ProductsAI
WordPress plugin ProfileGrid (User Profiles, Groups and Communities) versions from earliest release through 5.9.4.3 are affected. The Patchstack advisory at https://patchstack.com/database/wordpress/plugin/profilegrid-user-profiles-groups-and-communities/vulnerability/wordpress-profilegrid-plugin-5-9-4-3-php-object-injection-vulnerability confirms the vulnerability scope. The plugin is available through the official WordPress plugin repository and is used for building community sites with user profiles, groups, and member directories.
RemediationAI
Upgrade ProfileGrid to version 5.9.4.4 or later if available, as the advisory indicates 5.9.4.3 is the last vulnerable version. Check the official WordPress plugin repository or Metagauss vendor site for the latest patched release. The Patchstack reference at https://patchstack.com/database/wordpress/plugin/profilegrid-user-profiles-groups-and-communities/vulnerability/wordpress-profilegrid-plugin-5-9-4-3-php-object-injection-vulnerability should be monitored for patch confirmation and additional remediation guidance. If immediate patching is not feasible, implement these compensating controls: disable user registration to prevent attackers from obtaining low-privilege accounts (reduces attack surface but breaks legitimate community functionality), restrict ProfileGrid features to trusted administrator accounts only via WordPress role management (severely limits plugin utility), and implement web application firewall (WAF) rules to detect and block serialized PHP objects in POST parameters and cookies targeting ProfileGrid endpoints (may cause false positives with legitimate profile updates). Monitor PHP error logs and WordPress activity logs for unserialize() calls with unexpected object types or failed deserialization attempts as potential exploitation indicators.
Share
External POC / Exploit Code
Leaving vuln.today