What is the CVSS score of CVE-2026-16289?

CVE-2026-16289 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.1%.

Is there a public PoC exploit available for CVE-2026-16289?

Yes, a public proof-of-concept exploit is available for CVE-2026-16289. Prioritise patching immediately. EPSS: 0.1%.

Is there a patch available for CVE-2026-16289?

Yes, a patch is available for CVE-2026-16289. Update the affected software to the latest version immediately.

ProfileGrid CVE-2026-16289

EUVD-2026-52179 MEDIUM

Missing Authorization (CWE-862)

2026-08-03 WPScan

GHSA-2cgw-vj45-mqq4

WordPress Authentication Bypass Profilegrid Unknown

4.3

CVSS 3.1 · Vendor: WPScan

Severity by source

Vendor (WPScan) PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

vuln.today AI

4.3 MEDIUM

Network-accessible WordPress endpoint; subscriber account sufficient (PR:L); only pending member metadata disclosed so C:L; no write or availability impact applies.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (WPScan).

CVSS VectorVendor: WPScan

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Aug 03, 2026 - 19:42 vuln.today

CVSS changed

Aug 03, 2026 - 17:37 NVD

4.3 (MEDIUM)

Patch available

Aug 03, 2026 - 07:01 EUVD

CVE Published

Aug 03, 2026 - 06:00 cve.org

UNKNOWN (no severity yet)

CVE Published

Aug 03, 2026 - 06:00 cve.org

MEDIUM 4.3

DescriptionCVE.org

The ProfileGrid WordPress plugin before 6.0.0.0 does not perform authorization checks when listing a group's pending membership requests, allowing any authenticated user such as a Subscriber to disclose the names and request dates of the users awaiting approval to join any group, including private ones.

AnalysisAI

ProfileGrid WordPress plugin before version 6.0.0.0 exposes pending group membership request data to any authenticated user due to missing authorization checks on the listing endpoint. Any subscriber-level account can enumerate the names and request timestamps of users awaiting approval for any group, including groups configured as private. No active exploitation is confirmed (not in CISA KEV), though a public exploit exists via WPScan; EPSS of 0.13% (3rd percentile) places real-world exploitation probability as very low.

Technical ContextAI

ProfileGrid is a WordPress plugin providing group-based user profile and membership management (CPE: cpe:2.3:a:unknown:profilegrid:*:*:*:*:*:*:*:*). The root cause is CWE-862 (Missing Authorization): the plugin's internal handler for listing a group's pending membership requests does not invoke a capability check - such as WordPress's native current_user_can() - before returning results. Properly implemented WordPress plugins must gate privileged data reads behind role-based authorization checks; the absence of this check means any authenticated user can supply an arbitrary group ID and receive the pending member list regardless of their relationship to that group.

RemediationAI

Update the ProfileGrid WordPress plugin to version 6.0.0.0 or later, which introduces the missing authorization check on the pending membership request listing handler. The fix is confirmed as available per WPScan at https://wpscan.com/vulnerability/815a2245-6477-42a1-b08a-fa308a830be3/. If an immediate update is not feasible, a compensating control would be to restrict authenticated access on the WordPress site to trusted users only (i.e., remove open subscriber registration), which eliminates the PR:L attack surface - note this may prevent legitimate user sign-ups. Disabling the pending membership request display feature at the plugin level, if such a toggle exists, would also mitigate exposure without broader impact.