What is the CVSS score of CVE-2026-4609?

CVE-2026-4609 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N. EPSS exploitation probability: 0.0%.

Which versions of ProfileGrid WordPress Plugin are affected by CVE-2026-4609?

CVE-2026-4609 affects the ProfileGrid WordPress plugin (versions ≤5.9.8.4) and allows authenticated users to bypass group membership restrictions and access closed, paid, or restricted community…

How to fix or mitigate CVE-2026-4609?

Within 24 hours: inventory all WordPress installations running ProfileGrid and document current version numbers; disable ProfileGrid plugin on affected systems if alternative community management exists. Within 7 days: contact ProfileGrid vendor for patch availability timeline and interim guidance; implement WordPress role-based access controls to restrict authenticated user capabilities where possible. Within 30 days: apply vendor-released patch immediately upon availability; audit group membership logs (from vulnerability discovery date forward) to identify unauthorized group joins and remediate access.

ProfileGrid WordPress Plugin CVE-2026-4609

EUVD-2026-29954 HIGH

Missing Authorization (CWE-862)

2026-05-13 Wordfence

Authentication Bypass WordPress

7.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.1 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

May 13, 2026 - 14:45 vuln.today

CVE Published

May 13, 2026 - 13:27 nvd

HIGH 7.1

DescriptionCVE.org

The ProfileGrid - User Profiles, Groups and Communities plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the pm_invite_user function in all versions up to, and including, 5.9.8.4. This makes it possible for authenticated attackers, with Subscriber-level access and above, to add themselves or any registered user to any ProfileGrid group, including closed and paid groups, bypassing all authorization and payment gates.

AnalysisAI

Authenticated subscribers can bypass authorization gates and forcibly join any ProfileGrid group - including closed, paid, or restricted groups - through a missing capability check in the pm_invite_user function. Affects all ProfileGrid plugin versions up to 5.9.8.4. The vulnerability enables low-privilege users to circumvent membership restrictions and payment requirements, potentially exposing premium content and private community spaces. EPSS data not provided; no CISA KEV listing identified, indicating no confirmed widespread exploitation at time of analysis. CVSS 7.1 reflects high integrity impact due to authorization bypass capabilities.

Technical ContextAI

ProfileGrid is a WordPress plugin providing user profile management, group functionality, and community features with membership controls. The vulnerability exists in the pm_invite_user AJAX handler within class-profile-magic-public.php, which processes group membership requests without verifying user capabilities or authorization levels. Per WordPress security model, capability checks are required before privileged operations like group assignment. CWE-862 (Missing Authorization) indicates the function executes sensitive actions - adding users to groups - without validating whether the authenticated user has permission to perform that action. This differs from authentication bypass (verifying identity) as it specifically involves missing authorization checks (verifying permissions). The CPE identifies the vulnerable component as the metagauss:profilegrid plugin across all versions through 5.9.8.4, affecting WordPress sites using this community management functionality.

RemediationAI

Primary remediation: Update ProfileGrid plugin to version 5.9.8.5 or later, which implements proper capability checks per changeset https://plugins.trac.wordpress.org/changeset/3491679/. The patch adds authorization validation to the pm_invite_user function before processing group membership modifications. WordPress administrators should update via Dashboard → Plugins → Update or download from the official WordPress plugin repository. If immediate patching is not feasible, implement these compensating controls with noted trade-offs: (1) Restrict new user registration to administrator approval only (Settings → General → Membership → 'Anyone can register' to disabled) - this prevents attackers from creating subscriber accounts but blocks legitimate user onboarding and may impact site growth; (2) Audit existing group memberships for unauthorized users by reviewing ProfileGrid → Groups → [Group Name] → Members, looking for subscriber-level accounts in premium/restricted groups - labor-intensive for large communities; (3) Temporarily disable ProfileGrid AJAX endpoints for subscriber roles via custom WordPress plugin filtering 'wp_ajax_' hooks - requires PHP development expertise and breaks legitimate subscriber functionality. All workarounds reduce functionality; patching is strongly preferred. Verify remediation by attempting unauthorized group joins with test subscriber accounts post-update.