ProfileGrid User Profiles CVE-2026-4607

Authenticated access as a Subscriber-level user or higher is required. The WordPress site must have user registration enabled (Settings → General → Anyone can register) or the attacker must obtain Subscriber credentials through other means (social engineering, credential purchase, site signup). The ProfileGrid plugin must be active. No additional configuration, feature flags, or non-default settings are required to exploit the vulnerability-the AJAX actions are enabled by default in all installations up to 5.9.8.4. The vulnerability does NOT require administrator interaction, user interaction, or CSRF tokens (CVSS PR:L/UI:N). Limitation: unauthenticated attackers cannot exploit this vulnerability; authentication is mandatory. Limitation: attackers can only modify group and field settings within ProfileGrid's data model; they cannot achieve remote code execution or access sensitive data outside ProfileGrid's scope.

CVSS 4.3 with AV:N/AC:L/PR:L/UI:N reflects a network-accessible vulnerability requiring low authentication (Subscriber role) with low attack complexity and no user interaction. The integrity impact is limited (I:L), with no confidentiality or availability loss. Risk assessment signals are mixed: the moderate CVSS score and confirmed WordPress plugin context suggest real deployability, but the limitation to Subscriber-level authentication and integrity-only impact (no data exposure or service disruption) reduces real-world severity compared to unauthenticated remote code execution vulnerabilities. Wordfence reporting indicates legitimate security research discovery rather than active exploitation. The attack vector (network, low complexity) and authentication requirement (Subscriber+) align logically-any site with user registration enabled and a Subscriber-role attacker is at risk, but the impact is configuration tampering rather than system compromise. No EPSS score provided; this appears to be a disclosure-stage vulnerability with moderate but bounded risk.

An attacker creates a free Subscriber account on a WordPress site running ProfileGrid 5.9.8.4. Using browser developer tools or a custom script, the attacker sends a crafted AJAX POST request to pm_set_group_order with modified group ordering data. Because the AJAX handler lacks authorization checks, the request is processed without validating the attacker's role, and the site-wide group menu order is changed. The attacker repeats this for pm_set_field_order to reorder profile fields site-wide, disrupting the user experience or hiding fields from other users.