What is the CVSS score of CVE-2026-57697?

CVE-2026-57697 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N. EPSS exploitation probability: 0.5%.

Which versions of Profilegrid are affected by CVE-2026-57697?

Metagauss ProfileGrid WordPress plugin (versions 5.9.9.6 and earlier) contains an authentication bypass allowing unauthenticated attackers to hijack WordPress administrator accounts via the password…

How to fix or mitigate CVE-2026-57697?

Within 24 hours: identify all WordPress instances running ProfileGrid and immediately disable the plugin on any version 5.9.9.6 or earlier. Within 7 days: restrict WordPress administrative access to approved IP addresses, implement multi-factor authentication on all administrator accounts, and deploy WAF rules to block suspicious password recovery attempts. Within 30 days: migrate to an alternative plugin or await a patched version when released, and conduct a comprehensive audit of administrative account activity and permission changes since the vulnerability became known.

Profilegrid CVE-2026-57697

EUVD-2026-43357 HIGH

Authentication Bypass Using an Alternate Path or Channel (CWE-288)

2026-07-13 Patchstack

WordPress Authentication Bypass Profilegrid Wordpress Plugin Metagauss

7.5

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Primary rating from Vendor (Patchstack) · only source for this CVE.

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 13, 2026 - 10:51 vuln.today

CVE Published

Jul 13, 2026 - 08:41 cve.org

HIGH 7.5

DescriptionCVE.org

Authentication Bypass Using an Alternate Path or Channel vulnerability in Metagauss ProfileGrid profilegrid-user-profiles-groups-and-communities allows Password Recovery Exploitation.This issue affects ProfileGrid : from n/a through <= 5.9.9.6.

AnalysisAI

Authentication bypass in the Metagauss ProfileGrid WordPress plugin (versions up to and including 5.9.9.6) lets remote unauthenticated attackers abuse the password recovery flow as an alternate channel to hijack arbitrary user accounts, including administrators. Because the flaw is exploitable over the network with no privileges and no user interaction (CVSS 7.5, I:H), it enables full account takeover on affected WordPress sites. No public exploit is identified at time of analysis and it is not in CISA KEV, but the low attack complexity makes it an attractive target once details circulate.