What is the CVSS score of CVE-2026-16290?

CVE-2026-16290 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.1%.

Is there a public PoC exploit available for CVE-2026-16290?

Yes, a public proof-of-concept exploit is available for CVE-2026-16290. Prioritise patching immediately. EPSS: 0.1%.

Is there a patch available for CVE-2026-16290?

Yes, a patch is available for CVE-2026-16290. Update the affected software to the latest version immediately.

ProfileGrid CVE-2026-16290

EUVD-2026-53724 MEDIUM

Missing Authorization (CWE-862)

2026-08-06 WPScan

GHSA-9c4h-7vg9-5hh6

WordPress Authentication Bypass Profilegrid Unknown

5.3

CVSS 3.1 · Vendor: WPScan

Severity by source

Vendor (WPScan) PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

vuln.today AI

5.3 MEDIUM

Network-reachable unauthenticated handler with no prerequisites; confidentiality impact limited to member list disclosure only, with zero integrity or availability consequence.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (WPScan).

CVSS VectorVendor: WPScan

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Aug 06, 2026 - 16:22 vuln.today

Patch available

Aug 06, 2026 - 07:02 EUVD

CVE Published

Aug 06, 2026 - 06:00 cve.org

UNKNOWN (no severity yet)

CVE Published

Aug 06, 2026 - 06:00 cve.org

MEDIUM 5.3

DescriptionCVE.org

The ProfileGrid WordPress plugin before 6.0.0.0 does not perform authorization checks before returning a group's member list, and registers the handler for unauthenticated users, allowing any unauthenticated visitor to disclose the members and their identifiers of any group, including private or closed ones, bypassing the ProfileGrid WordPress plugin before 6.0.0.0's member-visibility setting.

AnalysisAI

ProfileGrid WordPress plugin (all versions before 6.0.0.0) exposes group member lists and member identifiers to unauthenticated visitors due to a handler registered without any authorization checks, completely bypassing the plugin's member-visibility settings for private and closed groups. Any unauthenticated visitor who can reach the WordPress site can enumerate group members and their identifiers across all group types, including those the site owner intended to restrict. A publicly available exploit exists per WPScan, and the SSVC classification flags this as automatable - though EPSS at 0.14% (4th percentile) indicates exploitation has not become widespread despite the low barrier to entry.

Technical ContextAI

ProfileGrid is a WordPress plugin providing user group functionality with configurable visibility levels (public, private, closed). The vulnerability (CWE-862: Missing Authorization) arises because the plugin registers a group membership retrieval handler - likely a WordPress AJAX action or REST API endpoint - without attaching any authentication or capability check middleware. WordPress's hook system allows handlers to be registered for both authenticated and unauthenticated contexts; the plugin erroneously registers this handler in the unauthenticated context, making it reachable without a valid session or nonce tied to group membership. Affected products are identified by CPE cpe:2.3:a:unknown:profilegrid:*:*:*:*:*:*:*:* covering all versions from 0 up to 6.0.0.0, across all platforms.

RemediationAI

The primary fix is to upgrade the ProfileGrid WordPress plugin to version 6.0.0.0 or later, which introduces proper authorization checks on the group member list handler. Site administrators should apply this update immediately via the WordPress admin dashboard or WP-CLI. Full advisory details are available at the WPScan entry https://wpscan.com/vulnerability/701607f3-34b1-4f69-990b-c9ce56b58087/. If an immediate upgrade is not feasible, the most effective compensating control is to deactivate the ProfileGrid plugin entirely until the patch is applied - this eliminates the exposed endpoint but also disables all group functionality for site users, which may not be acceptable. Alternatively, a web application firewall (WAF) rule blocking unauthenticated POST or GET requests to the specific WordPress AJAX action or REST route that returns group membership data can mitigate exposure without full deactivation; however, identifying the exact endpoint requires reviewing plugin code or WPScan's technical disclosure. Generic IP-based rate limiting is insufficient given the low-friction nature of this read-only disclosure.