EUVD-2026-48489
GHSA-pp2q-mfv3-q5wp
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAccess plugin PayPal IPN endpoint
-
ExploitExploit missing verification via crafted notification
-
ExecutionExecute membership upgrade without payment
-
ImpactImpact: user gains paid group access
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Access control enforcement
MITRE ATT&CK
1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | No special conditions - remote unauthenticated exploitation against default configurations of the ProfileGrid plugin when the PayPal IPN integration is enabled. The only requirement is that the WordPress site has the PayPal IPN feature active; if this feature is disabled, the vulnerable endpoint is not exposed, limiting the attack surface. |
| Impact | The CVSS 6.5 (medium) vector reflects remote, low-complexity, unauthenticated exploitation with low confidentiality and integrity impact. The EPSS probability (0.14%) is low despite a public exploit (POC) being available, suggesting limited real-world interest or exploitation. The SSVC framework rates this as automatable with partial technical impact, meaning automated attacks are feasible but the damage is confined to membership status manipulation. No CISA KEV listing exists, confirming no known active exploitation in the wild. Conflict: The availability of a public POC combined with a low EPSS score may indicate that the vulnerability is not widely targeted or that affected deployments are limited. |
| Exploit ScenarioDerived | An attacker sends a crafted HTTP POST request to the ProfileGrid IPN callback URL, impersonating a valid PayPal payment notification. The request upgrades a specified user account to a paid group member without any actual payment. A public proof-of-concept exploit is available, enabling even less sophisticated attackers to execute the attack. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 27, 2026
Authentication bypass in ProfileGrid WordPress plugin allows unauthenticated attackers to forge PayPal IPN payment notifications, granting paid membership to any group without payment. The vulnerability affects all versions before 5.9.9.7. A public proof-of-concept exploit is available, though the EPSS score (0.14%, percentile 3) indicates low likelihood of widespread exploitation at this time.
RemediationAI
Update the ProfileGrid plugin to version 5.9.9.7 or later, which is the vendor-released patch. The advisory and patch details are available from WPScan (referenced above). As a workaround, if immediate updating is not possible, disable the PayPal IPN integration feature in the plugin settings; this will prevent the vulnerable endpoint from being reachable but will also halt legitimate payment notifications. The trade-off is that manual payment management would be required.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability arises from the plugin's failure to verify PayPal Instant Payment Notification (IPN) callbacks. IPN is a PayPal service that sends automated notifications to merchants; without cryptographic verification or secret validation, an attacker can send a spoofed HTTP request to the plugin's IPN handler, bypassing payment checks. CWE-284 (Improper Access Control) classifies this as a missing authorization on a critical function. The affected software is the ProfileGrid WordPress plugin, as identified by CPE cpe:2.3:a:unknown:profilegrid, with versions prior to 5.9.9.7.
Know when Profilegrid gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Network exploitable without auth or interaction; integrity impact limited to membership status.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
4DescriptionCVE.org
The ProfileGrid WordPress plugin before 5.9.9.7 does not verify PayPal IPN notifications before granting paid group membership, allowing unauthenticated attackers to forge a payment notification and mark any user as a paid member of any group without any payment being made.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
More in Profilegrid
View allImproper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Metagauss ProfileG
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Metagauss ProfileG
PHP object injection in the Frontend Dashboard WordPress plugin before 3.0.5 and the ProfileGrid WordPress plugin before
The ProfileGrid WordPress plugin before 5.3.1 provides an AJAX endpoint for resetting a user password but does not imple
The profilegrid-user-profiles-groups-and-communities plugin before 2.8.6 for WordPress has remote code execution via an
Privilege escalation in the ProfileGrid WordPress plugin before 5.9.9.8 lets unauthenticated visitors self-register into
The ProfileGrid WordPress plugin before 5.1.1 does not sanitise and escape a parameter before outputting it back in the
Missing authorization checks in ProfileGrid WordPress plugin prior to 5.9.9.7 allow authenticated subscribers to manipul
ProfileGrid WordPress plugin (all versions before 6.0.0.0) exposes group member lists and member identifiers to unauthen
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Metagauss ProfileG
The ProfileGrid - User Profiles, Groups and Communities plugin for WordPress is vulnerable to PHP Object Injection in al
The ProfileGrid - User Profiles, Groups and Communities plugin for WordPress is vulnerable to privilege escalation in al
Exploit-DB