What is the CVSS score of CVE-2026-12073?

CVE-2026-12073 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of ProfileGrid are affected by CVE-2026-12073?

The ProfileGrid WordPress plugin (all versions through 5.9.9.5) contains a critical account takeover vulnerability enabling remote attackers to seize administrator account control through…

How to fix or mitigate CVE-2026-12073?

WITHIN 24 HOURS: Deactivate ProfileGrid plugin immediately; audit administrator account (user ID 1) for unauthorized email changes, password resets, or suspicious access activity. WITHIN 7 DAYS: Force password reset on all administrator accounts, enable two-factor authentication, review WordPress login activity logs for suspicious access, and confirm no unauthorized API tokens or application passwords exist. WITHIN 30 DAYS: Monitor Wordfence Security and ProfileGrid vendor advisory channels for patch availability; identify and stage alternative community/groups plugin solution as contingency if patch unavailable within 60 days.

ProfileGrid CVE-2026-12073

EUVD-2026-40254 CRITICAL

Authorization Bypass Through User-Controlled Key (CWE-639)

2026-06-30 Wordfence

GHSA-5949-6pq3-mp7g

WordPress Authentication Bypass Privilege Escalation Wordpress Plugin Profilegrid User Profiles Groups And Communities Metagauss

9.8

CVSS 3.1 · Vendor: Wordfence

Severity by source

Vendor (Wordfence) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

9.8 CRITICAL

Unauthenticated network registration request with no user interaction yields admin takeover, so AV:N/AC:L/PR:N/UI:N and full C/I/A impact.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Wordfence).

CVSS VectorVendor: Wordfence

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 30, 2026 - 06:16 vuln.today

CVE Published

Jun 30, 2026 - 05:34 cve.org

CRITICAL 9.8

DescriptionCVE.org

The ProfileGrid - User Profiles, Groups and Communities plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 5.9.9.5. This is due to the plugin not validating a user_login on registration forms that don't contain this parameter, and not properly handling the error messages. This makes it possible for unauthenticated attackers to change email address of user account with ID=1 (usually an administrator), and leverage that to reset the user's password and gain access to their account.

Articles & Coverage 2

News 7 New WordPress Vulnerabilities - 2 Critical, 5 High, 2 With POC Jul 01, 2026 News Critical Account Takeover in WordPress ProfileGrid Plugin ≤5.9.9.5 - CVE-2026-12073 Jun 30, 2026

AnalysisAI

Account takeover in the ProfileGrid - User Profiles, Groups and Communities WordPress plugin (all versions through 5.9.9.5) lets unauthenticated remote attackers hijack the site administrator account. The plugin fails to validate a user_login value on registration forms lacking that parameter and mishandles the resulting error messages, allowing an attacker to overwrite the email address of the user with ID=1 (typically the admin) and then trigger a password reset to seize full control. Reported by Wordfence with a 9.8 CVSS; no public exploit identified at time of analysis.

Technical ContextAI

The flaw lives in ProfileGrid's user-registration/profile workflow for WordPress, a PHP application layer that maps form submissions to WordPress user records. The root cause is CWE-639 (Authorization Bypass Through User-Controlled Key, i.e. insecure direct object reference): when a registration form omits the user_login parameter, the plugin neither requires nor validates it, and its error-handling path can be steered to operate against an arbitrary, attacker-chosen user object - specifically the record with ID=1. Because WordPress conventionally assigns ID=1 to the first/administrator account, an authorization decision that should be keyed to the registering user is instead driven by an attacker-influenced identifier, permitting modification of another user's email field. The affected component is identified by CPE cpe:2.3:a:metagauss:profilegrid_-_user_profiles,_groups_and_communities, the Metagauss-developed plugin.

RemediationAI

Upstream fix available (changeset/commit); released patched version not independently confirmed from the provided data - the fix is committed at https://plugins.trac.wordpress.org/changeset/3578435/, so update ProfileGrid to the first release published after 5.9.9.5 (verify the exact patched version in the Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/2d35279d-299e-4ca2-8f84-165284e058c8?source=cve before deploying). Until patched, restrict or disable public/front-end ProfileGrid registration forms so unauthenticated submissions cannot reach the vulnerable handler (trade-off: blocks legitimate self-service signups); place a WAF rule or web-server restriction in front of the registration endpoint to require the user_login parameter and reject submissions that omit it; and as a containment measure, change the administrator account away from user ID=1 where feasible and enable multi-factor authentication plus password-reset alerting on admin accounts so an unauthorized email change is detected (trade-off: operational overhead and does not close the underlying flaw).