What is the CVSS score of CVE-2026-4607?

CVE-2026-4607 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.0%.

ProfileGrid User Profiles CVE-2026-4607

EUVD-2026-29952 MEDIUM

Missing Authorization (CWE-862)

2026-05-13 Wordfence

Authentication Bypass WordPress

4.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

May 13, 2026 - 14:45 vuln.today

CVE Published

May 13, 2026 - 13:27 nvd

MEDIUM 4.3

DescriptionCVE.org

The ProfileGrid - User Profiles, Groups and Communities plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 5.9.8.4. This is due to the plugin not properly verifying that a user is authorized to perform an action via the pm_set_group_order, pm_set_group_items, and pm_set_field_order AJAX actions. This makes it possible for authenticated attackers, with Subscriber-level access and above, to modify site-wide ProfileGrid group settings including group menu order, group list order, group icon display, and field ordering.

AnalysisAI

Authentication bypass in ProfileGrid - User Profiles, Groups and Communities WordPress plugin up to version 5.9.8.4 allows authenticated Subscriber-level users to modify site-wide group settings through unprotected AJAX actions (pm_set_group_order, pm_set_group_items, pm_set_field_order). Attackers can alter group menu order, list order, icon display, and field ordering without authorization checks. No public exploit code or active exploitation has been identified; CVSS 4.3 (low-moderate severity) reflects limited impact scope to integrity without confidentiality or availability impact.

Technical ContextAI

ProfileGrid is a WordPress plugin that manages user profiles, groups, and community features. The vulnerability stems from missing authorization verification (CWE-862: Missing Authorization) in three AJAX action handlers within the admin class. These handlers process group configuration changes but fail to validate that the requesting user has administrative privileges before executing sensitive operations. The affected AJAX actions are invoked client-side without capability checks, allowing any authenticated user with Subscriber role or higher to craft malicious AJAX requests and modify group metadata stored in the WordPress database. The plugin relies on WordPress's default role-based access control (capabilities), but the AJAX handlers bypass these checks entirely.

RemediationAI

Update ProfileGrid - User Profiles, Groups and Communities plugin to version 5.9.8.5 or later (patched version available per WordPress plugin repository changeset 3491679). The patch adds proper authorization checks to the pm_set_group_order, pm_set_group_items, and pm_set_field_order AJAX actions, ensuring only users with appropriate administrative capabilities can modify group settings. If immediate patching is not feasible, restrict Subscriber-level user registration or disable user registration entirely via Settings → General → Membership in WordPress admin panel; this eliminates the attack surface for unauthenticated attackers but may impact site functionality. Alternatively, use a WordPress user role plugin (e.g., Members or User Role Editor) to audit and restrict Subscriber capabilities, removing access to community features if not needed. Monitor group settings and field ordering for unexpected changes via the WordPress database or audit logs. Apply the patch as soon as possible, as the fix is minimal and low-risk.