ProfileGrid CVE-2026-12073

The site must run the ProfileGrid plugin (≤ 5.9.9.5) with a reachable front-end registration form that does not include the user_login parameter - that specific form configuration is the triggering condition named in the description. Exploitation further depends on a privileged target existing at user ID=1 (the WordPress default for the administrator) and on that account's password-reset flow being usable once its email is changed. Limiting factors: it requires the registration form to be publicly accessible/enabled, and an environment where the admin has been moved off ID=1 or where admin email changes trigger confirmation/alerts reduces the practical impact. Authentication is not required - the CVSS vector is PR:N, so this is unauthenticated.

All signals point the same direction for ease of exploitation: the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) describes a network-reachable, low-complexity, unauthenticated attack requiring no user interaction, with full C/I/A impact (9.8 critical). This is a credible high-priority issue because the outcome is direct administrator account takeover of an internet-facing CMS, and WordPress admin-takeover bugs are routinely automated. Tempering that: this is not on CISA KEV (no confirmed active exploitation) and no public proof-of-concept is referenced, so EPSS-style widespread-exploitation probability is not established in the provided data - treat exploitation as plausible and attractive but not yet confirmed in the wild. No SSVC decision values or EPSS score were supplied; the assessment of automatability and technical impact here is inferred from the CVSS vector and the description, not from a vendor SSVC record.

An attacker locates a WordPress site running ProfileGrid and submits a crafted registration request to a form that omits the user_login parameter, abusing the unvalidated input and mishandled error path to overwrite the email address of the user with ID=1 (the admin). The attacker then requests a WordPress password reset, receives the reset link at their attacker-controlled email, and logs in as administrator - all without authentication or user interaction. No public proof-of-concept is referenced, but the AV:N/AC:L attack profile makes scripted, opportunistic exploitation straightforward.