ProfileGrid CVE-2026-16291

Exploitation requires an account with at least Subscriber-level authentication on the target WordPress site - on sites with open user registration, this is trivially obtainable by anyone. The vulnerability is present in the notification deletion functionality of ProfileGrid specifically; it does not affect installations where ProfileGrid is not active. No additional configuration or feature toggle is required beyond the plugin being installed and active. Exploitation is limited by the authentication prerequisite: sites that disable public user registration and restrict account creation to administrators significantly reduce the attacker pool to already-trusted users. There is no requirement for the attacker to know specific victim usernames - notification IDs alone are sufficient for exploitation.

The composite risk picture is moderate-to-low. CVSS 4.3 (Medium) and the impact dimensions (C:N/I:L/A:N) correctly reflect that the vulnerability is limited to deleting other users' notifications - a nuisance-tier integrity impact with no data exposure or availability consequence. EPSS at 0.13% (3rd percentile) indicates that exploitation has not been broadly observed in threat intelligence feeds, despite a publicly available exploit from WPScan. No CISA KEV listing is present, further corroborating the absence of confirmed active mass exploitation. The primary risk multiplier is deployment context: on community or membership sites where ProfileGrid is used for user communication, bulk deletion of notifications could disrupt workflows or be used for targeted harassment. The authentication requirement (PR:L) is a meaningful barrier on sites that do not allow open registration, but effectively disappears on sites with subscriber self-registration enabled. This is a real but niche-impact vulnerability - prioritize patching on community-facing WordPress installations; deprioritize on tightly controlled deployments with no public registration.

An attacker registers a free Subscriber account on a WordPress site running a vulnerable version of ProfileGrid. Using the publicly available WPScan proof-of-concept, they iterate over sequential notification IDs in authenticated DELETE requests to the plugin's notification endpoint, successfully deleting other users' pending notifications without any server-side ownership check rejecting the requests.