ProfileGrid CVE-2026-12687

Exploitation requires that the target site has ProfileGrid's front-end registration enabled AND that at least one ProfileGrid group is configured to map to a privileged WordPress role (Administrator being the worst case) that an anonymous user can select during registration. Per the CVSS vector (AV:N/AC:L/PR:N/UI:N), no authentication, no user interaction, and only low complexity are needed to reach and abuse the registration endpoint. The key limiting factor is configuration-dependent: if no privileged-role group exists or front-end registration is disabled, the maximum achievable role is bounded by whatever group the attacker can join, substantially reducing impact. The vulnerable version boundary is any ProfileGrid release before 5.9.9.8.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) confirms this is remotely and unauthenticatedly exploitable with low complexity and no user interaction - a strong exploitability profile that is reinforced by publicly available exploit code from WPScan. However, the signals conflict on impact: the vendor CVSS scores only C:H with I:N/A:N (7.5), yet the description describes registering into an Administrator-role group, which is an integrity/privilege compromise that would normally carry I:H and likely a scope change - so the published 7.5 appears to understate real-world impact. Countering the urgency, EPSS is only 0.15% (4th percentile) and the CVE is not listed in CISA KEV, indicating no confirmed active or widespread exploitation despite the POC. Net assessment: this is a genuine, easily exploitable privilege-escalation priority for any site running a vulnerable ProfileGrid version that has an Administrator- or otherwise privileged-role group configured; sites with only low-privilege groups face reduced (but non-zero) risk. No SSVC decision data was provided in the input.

An unauthenticated attacker browses to a WordPress site running vulnerable ProfileGrid, opens the front-end registration form, and submits a registration request while manipulating the group parameter to reference a privileged group (one mapped to the Administrator role). Because the server does not authorize the requested group, the attacker's new account is granted administrator capabilities, giving full control of the site. Publicly available exploit code from WPScan lowers the skill required to carry this out.