EUVD-2026-51946
GHSA-77fq-7qxg-43vp
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Network-reachable IDOR requiring only Subscriber authentication; impact confined to deleting others' notifications with no confidentiality or availability consequence.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
5DescriptionCVE.org
The ProfileGrid WordPress plugin before 5.9.9.8 does not verify that a notification belongs to the requesting user before deleting it, allowing any authenticated user such as a Subscriber to delete other users' notifications by enumerating notification identifiers.
AnalysisAI
Insecure Direct Object Reference (IDOR) in the ProfileGrid WordPress plugin before 5.9.9.8 allows any authenticated user - including low-privilege Subscribers - to delete arbitrary other users' notifications by enumerating integer notification identifiers. The plugin's notification deletion endpoint fails to verify that the requested notification belongs to the authenticated requester, exposing all users' notifications to deletion by any site member. A publicly available exploit exists per WPScan, though EPSS sits at 0.13% (3rd percentile), indicating low observed exploitation activity at time of analysis.
Technical ContextAI
ProfileGrid is a WordPress user management and community plugin (CPE: cpe:2.3:a:unknown:profilegrid:*:*:*:*:*:*:*:*) that provides user profiles, groups, and notification systems. The root cause is CWE-639 (Authorization Bypass Through User-Controlled Key): the deletion handler accepts a notification ID as a user-supplied parameter and acts on it without confirming ownership - a textbook IDOR pattern. Because WordPress notification records are typically assigned sequential or predictable integer IDs, an attacker can trivially enumerate valid identifiers. The WordPress subscriber role requires only free registration on most sites, making the authentication barrier low. The CVSS vector AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N precisely characterizes the flaw: network-reachable, no complexity, low privilege, no interaction, limited integrity impact.
RemediationAI
Update ProfileGrid to version 5.9.9.8 or later, which contains the vendor-released patch for this vulnerability (per WPScan advisory https://wpscan.com/vulnerability/899c2e96-39a9-4e1c-879b-40d6e629e712/). This is the primary and recommended remediation. As an interim workaround on sites that cannot immediately update, disabling open subscriber registration reduces the attacker pool to already-trusted authenticated users, mitigating opportunistic abuse - though this may be disruptive to community sites by design. There is no indication that the notification feature itself can be disabled independently without breaking ProfileGrid's core functionality. Rate-limiting or WAF rules on the notification deletion endpoint may reduce bulk enumeration but will not prevent targeted deletion by a determined authenticated user.
More in Profilegrid
View allImproper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Metagauss ProfileG
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Metagauss ProfileG
The ProfileGrid WordPress plugin before 5.3.1 provides an AJAX endpoint for resetting a user password but does not imple
The profilegrid-user-profiles-groups-and-communities plugin before 2.8.6 for WordPress has remote code execution via an
Privilege escalation in the ProfileGrid WordPress plugin before 5.9.9.8 lets unauthenticated visitors self-register into
Authentication bypass in ProfileGrid WordPress plugin allows unauthenticated attackers to forge PayPal IPN payment notif
The ProfileGrid WordPress plugin before 5.1.1 does not sanitise and escape a parameter before outputting it back in the
Missing authorization checks in ProfileGrid WordPress plugin prior to 5.9.9.7 allow authenticated subscribers to manipul
ProfileGrid WordPress plugin (all versions before 6.0.0.0) exposes group member lists and member identifiers to unauthen
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Metagauss ProfileG
The ProfileGrid - User Profiles, Groups and Communities plugin for WordPress is vulnerable to PHP Object Injection in al
The ProfileGrid - User Profiles, Groups and Communities plugin for WordPress is vulnerable to privilege escalation in al
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today