ProfileGrid CVE-2026-57759

Exploitation requires that a user already authenticated to a WordPress site running ProfileGrid <= 5.9.9.7 be tricked into visiting an attacker-controlled page while their session is active (CVSS UI:R). No attacker authentication or privileges are needed (PR:N), and the attack is network-delivered (AV:N) with low complexity (AC:L). The severity of the account-takeover outcome scales with the victim's privilege level - hijacking an administrator yields full site control, whereas a low-privilege member victim yields limited impact. Limiting factors: the mandatory victim interaction, the need for the victim to have a live authenticated session, and reliance on the plugin's vulnerable account-management action being reachable.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 8.8) indicates a network-reachable, low-complexity attack requiring no attacker privileges but requiring victim interaction (UI:R) - the victim must visit a malicious page while authenticated. This UI:R requirement is the key limiting factor and typically means real-world exploitation is opportunistic/social-engineering-driven rather than fully automatable, which tempers the otherwise high score. There is no EPSS score, KEV entry, or POC provided in the intelligence, so there is no evidence of active exploitation or widespread automated attacks; the finding is a Patchstack research disclosure. The high C/I/A ratings reflect the account-takeover outcome (particularly severe if an administrator is the victim) rather than direct data theft, so priority should track the privilege level of likely victims on a given site.

An attacker crafts a malicious web page (or email link) containing a hidden auto-submitting form targeting ProfileGrid's account-management action. When a logged-in ProfileGrid site administrator visits the page, their browser silently submits the forged request in their authenticated session, altering their account (e.g., resetting credentials or email) and handing the attacker control. No public exploit is identified, and the low attack complexity means only basic social engineering is needed to reach the victim.