ProfileGrid CVE-2026-16290

No special conditions are required beyond network access to a WordPress site running ProfileGrid before version 6.0.0.0 - the vulnerable handler is explicitly registered for unauthenticated users and requires no session, nonce, or credentials. The attacker must supply a valid group ID, which in WordPress are typically sequential integers and trivially enumerable. The primary limiting factor is that impact is confined to member list and identifier disclosure only - no code execution, no data modification, and no availability impact. The bypass is specifically meaningful only when private or closed groups exist on the site; installations using exclusively public groups gain no additional exposure from this flaw beyond what is already intentionally public.

The CVSS 3.1 score of 5.3 (Medium) with vector AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N accurately reflects the attack surface: network-reachable, no complexity or privileges required, no user interaction, but impact limited to partial confidentiality - specifically member identity disclosure only, with no integrity or availability consequences. EPSS at 0.14% (4th percentile) is notably low despite POC availability, suggesting exploitation has not become mass-automated in practice. The SSVC automatable:yes classification highlights that once an attacker identifies a target site, exploitation can be scripted with no friction. The vulnerability is not in CISA KEV, so confirmed active exploitation is not established. Real-world risk is most significant for deployments where group membership is sensitive - support communities, confidential forums, or professional networks - as member identity disclosure can enable targeted social engineering. For sites using only public groups, the incremental exposure is negligible.

An unauthenticated attacker sends a crafted HTTP request to the ProfileGrid group membership endpoint - requiring only knowledge of sequential WordPress group IDs - and receives the full member list and user identifiers for any group, including private or closed ones. A publicly available exploit exists per WPScan, meaning this process can be scripted to enumerate all groups and their members across a target site in seconds. The harvested member identities can then be used to build targeted phishing campaigns or map organizational relationships for further attacks.