ProfileGrid WordPress Plugin CVE-2026-4609

Requires authenticated WordPress account with Subscriber-level privileges or above. WordPress sites with open user registration (the default 'Anyone can register' setting) meet this condition, allowing attackers to self-provision the required authenticated session. The vulnerability affects the pm_invite_user AJAX handler, which is accessible to all authenticated users regardless of group settings. Exploitation succeeds against closed groups (administrator approval required), paid groups (payment processing required), and restricted groups (membership tier requirements) - the missing capability check bypasses ALL authorization mechanisms ProfileGrid implements. Sites not using ProfileGrid's group functionality or those with completely disabled user registration have reduced attack surface, though existing compromised subscriber accounts could still exploit this. No specific server configuration, non-default WordPress settings, or special ProfileGrid features must be enabled; the vulnerable code path executes whenever the plugin is active and an authenticated user calls the pm_invite_user function. User interaction is not required (UI:N). Scope is unchanged (S:U), meaning the attacker cannot escalate beyond the WordPress application context, but within that context can access any ProfileGrid group without limitation.

Real-world risk assessment requires balancing multiple signals. CVSS vector (AV:N/AC:L/PR:L/UI:N) indicates network-exploitable with low complexity but requires low-privilege authentication (subscriber account). The 7.1 severity stems from high integrity impact (I:H) - attackers gain unauthorized group memberships - but limited confidentiality impact (C:L) and no availability impact. Without EPSS data, statistical exploitation probability cannot be quantified. No CISA KEV listing suggests this is not yet broadly exploited in the wild. However, the attack barrier is low: WordPress subscriber accounts are trivially obtainable on most sites through self-registration. The impact severity depends heavily on deployment context - sites using ProfileGrid for paid membership tiers or confidential communities face revenue loss and data exposure; sites using it purely for public organization face minimal risk. Source code references confirm the exact vulnerable code paths, increasing confidence this is exploitable. The lack of POC availability data prevents confirming whether exploit tooling exists, but the straightforward nature of capability check bypasses typically makes exploitation development trivial for WordPress security practitioners. SSVC classification: exploitation state unknown, highly automatable (simple AJAX request), moderate-to-major technical impact depending on group content sensitivity. Priority should be elevated for revenue-generating membership sites or those hosting sensitive community data.

An attacker registers a free subscriber account on a WordPress site using ProfileGrid for paid membership communities. They identify premium groups by enumerating group IDs through site navigation or API responses. Using browser developer tools or an HTTP proxy, the attacker crafts an authenticated AJAX POST request to wp-admin/admin-ajax.php with action=pm_invite_user, their user ID, and the target premium group ID. The vulnerable pm_invite_user function processes this request without checking whether the subscriber has authorization to join paid/closed groups, immediately granting membership. The attacker now accesses premium content, private discussions, and restricted resources intended for paying members, bypassing all payment gates and membership tier restrictions.