ProfileGrid CVE-2026-16289

A valid WordPress account at subscriber role or higher is required - unauthenticated exploitation is not possible (CVSS PR:L). The target site must have the ProfileGrid plugin installed and active with at least one group configured. The vulnerability is triggered by directly calling the pending membership request listing endpoint with any target group ID; no special group membership or admin relationship to the target group is needed. Exploitation is limited to disclosure of pending member usernames and request dates only - passwords, email addresses, and group content are not exposed. The SSVC assessment notes the attack is not automatable, and the 3rd-percentile EPSS score indicates opportunistic mass exploitation is not observed. Sites that do not allow open user registration effectively have no exposure.

The CVSS 3.1 score of 4.3 (Medium) is well-calibrated here: the attack vector is network-accessible (AV:N), complexity is low (AC:L), but a valid low-privilege account is required (PR:L) and impact is limited to partial confidentiality (C:L, I:N, A:N). EPSS at 0.13% (3rd percentile) strongly suggests opportunistic exploitation is rare despite the public POC on WPScan. SSVC corroborates this - exploitation is assessed as 'none' at time of analysis and the vulnerability is marked not automatable, suggesting targeted rather than mass exploitation. The exposed data (pending member names and request dates) is sensitive in privacy terms but does not include credentials, emails, or content, capping blast radius. This is a genuine medium-priority issue for sites that run private or sensitive-membership groups; for default public WordPress installations the real-world risk is low.

An attacker registers a free subscriber-level account on a WordPress site running ProfileGrid. Using the public exploit code published by WPScan, they issue authenticated HTTP requests to the plugin's pending-request listing endpoint supplying arbitrary group IDs, including those of private groups they do not belong to. The plugin returns the names and request timestamps of all pending members for each queried group, enabling enumeration of private group activity across the site.