What is the CVSS score of CVE-2026-57759?

CVE-2026-57759 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of ProfileGrid are affected by CVE-2026-57759?

ProfileGrid WordPress plugin (versions 5.9.9.7 and earlier) contains a cross-site request forgery vulnerability that allows unauthenticated attackers to force unauthorized account changes for any…

How to fix or mitigate CVE-2026-57759?

Within 24 hours: Disable ProfileGrid plugin (all versions ≤5.9.9.7) on all WordPress installations and restrict access to wp-admin via IP allowlisting. Within 7 days: Enforce multi-factor authentication for all administrator accounts; implement CSRF token validation rules via web application firewall; audit admin activity logs for unauthorized account modifications. Within 30 days: Monitor plugin vendor for patch release; upon availability, test patch in staging environment and deploy to production; conduct full audit of WordPress user permissions and recent login history.

ProfileGrid CVE-2026-57759

EUVD-2026-41315 HIGH

Cross-Site Request Forgery (CSRF) (CWE-352)

2026-07-02 Patchstack

GHSA-r89c-xvf4-jw2p

WordPress CSRF Profilegrid Wordpress Plugin Metagauss

8.8

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Network CSRF needs no attacker auth (PR:N) but requires the victim to click (UI:R); account takeover of a privileged user yields high C/I/A within an unchanged scope.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 02, 2026 - 12:22 vuln.today

DescriptionCVE.org

Unauthenticated Cross Site Request Forgery (CSRF) in ProfileGrid <= 5.9.9.7 versions.

AnalysisAI

Cross-site request forgery in the ProfileGrid - User Profiles, Groups and Communities WordPress plugin (versions 5.9.9.7 and earlier) allows a remote unauthenticated attacker to force a logged-in victim into performing unintended state-changing actions, chaining to full account takeover. Because a successful CSRF against an administrator can hijack a privileged account, impact is rated high across confidentiality, integrity, and availability (CVSS 8.8). No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.

Technical ContextAI

ProfileGrid (vendor Metagauss, CPE cpe:2.3:a:metagauss:profilegrid) is a WordPress plugin that adds front-end user profiles, membership groups, and community features to WordPress sites. The root cause is CWE-352 (Cross-Site Request Forgery): one or more of the plugin's account/profile management actions accept state-changing requests without validating a WordPress anti-CSRF nonce or equivalent unpredictable token. As a result, a request forged by an attacker's page and submitted in the victim's authenticated session context is processed as legitimate, letting the attacker drive account-modifying operations (the 'CSRF to Account Takeover' path described by Patchstack).

RemediationAI

Upgrade ProfileGrid to a release newer than 5.9.9.7 (Upstream fix available per the Patchstack advisory; a specific released patched version is not independently confirmed in the provided data - consult the vendor/WordPress plugin page for the exact fixed build before deploying). Because the flaw requires an authenticated victim to be lured to a malicious page, effective compensating controls until patching include: instructing administrators and privileged users to log out of wp-admin when not in use and to avoid browsing untrusted sites in the same session; deploying a WAF or virtual patch (Patchstack offers one) to block forged requests to the plugin's account-management endpoints; and restricting or monitoring changes to high-privilege accounts. Full advisory: https://patchstack.com/database/wordpress/plugin/profilegrid-user-profiles-groups-and-communities/vulnerability/wordpress-profilegrid-plugin-5-9-9-7-csrf-to-account-takeover-vulnerability?_s_id=cve. Trade-off: session-logout and browsing-hygiene controls depend on user discipline and do not fully close the gap, so patching remains the only complete fix.