EUVD-2026-48489
GHSA-pp2q-mfv3-q5wp
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Network exploitable without auth or interaction; integrity impact limited to membership status.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
5DescriptionCVE.org
The ProfileGrid WordPress plugin before 5.9.9.7 does not verify PayPal IPN notifications before granting paid group membership, allowing unauthenticated attackers to forge a payment notification and mark any user as a paid member of any group without any payment being made.
AnalysisAI
Authentication bypass in ProfileGrid WordPress plugin allows unauthenticated attackers to forge PayPal IPN payment notifications, granting paid membership to any group without payment. The vulnerability affects all versions before 5.9.9.7. A public proof-of-concept exploit is available, though the EPSS score (0.14%, percentile 3) indicates low likelihood of widespread exploitation at this time.
Technical ContextAI
The vulnerability arises from the plugin's failure to verify PayPal Instant Payment Notification (IPN) callbacks. IPN is a PayPal service that sends automated notifications to merchants; without cryptographic verification or secret validation, an attacker can send a spoofed HTTP request to the plugin's IPN handler, bypassing payment checks. CWE-284 (Improper Access Control) classifies this as a missing authorization on a critical function. The affected software is the ProfileGrid WordPress plugin, as identified by CPE cpe:2.3:a:unknown:profilegrid, with versions prior to 5.9.9.7.
RemediationAI
Update the ProfileGrid plugin to version 5.9.9.7 or later, which is the vendor-released patch. The advisory and patch details are available from WPScan (referenced above). As a workaround, if immediate updating is not possible, disable the PayPal IPN integration feature in the plugin settings; this will prevent the vulnerable endpoint from being reachable but will also halt legitimate payment notifications. The trade-off is that manual payment management would be required.
More in Profilegrid
View allImproper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Metagauss ProfileG
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Metagauss ProfileG
The ProfileGrid WordPress plugin before 5.3.1 provides an AJAX endpoint for resetting a user password but does not imple
The profilegrid-user-profiles-groups-and-communities plugin before 2.8.6 for WordPress has remote code execution via an
Privilege escalation in the ProfileGrid WordPress plugin before 5.9.9.8 lets unauthenticated visitors self-register into
The ProfileGrid WordPress plugin before 5.1.1 does not sanitise and escape a parameter before outputting it back in the
Missing authorization checks in ProfileGrid WordPress plugin prior to 5.9.9.7 allow authenticated subscribers to manipul
ProfileGrid WordPress plugin (all versions before 6.0.0.0) exposes group member lists and member identifiers to unauthen
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Metagauss ProfileG
The ProfileGrid - User Profiles, Groups and Communities plugin for WordPress is vulnerable to PHP Object Injection in al
The ProfileGrid - User Profiles, Groups and Communities plugin for WordPress is vulnerable to privilege escalation in al
The ProfileGrid plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability chec
Same weakness CWE-284 – Improper Access Control
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today