EUVD-2026-90807
GHSA-rq8q-x9jv-jf8h
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach ProfileGrid endpoint on target site
-
ExploitEnumerate/substitute object identifier (IDOR key)
-
ExecutionBypass misconfigured access-control level
-
ImpactRead another user's or group's data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Object-level authorization, IDOR prevention
|
| Exploitation Conditions | Requires a running WordPress site with the Metagauss ProfileGrid plugin (profilegrid-user-profiles-groups-and-communities) at or below version 6.0.0.2, where access-control security levels are configured such that an object/user identifier is accepted without a proper ownership check. No authentication, no special privilege, and no user interaction are needed (PR:N/UI:N), making default network-reachable installations exploitable; the practical limit is that impact is confined to reading data exposed via the vulnerable reference (C:L) and that the attacker must know or enumerate valid object identifiers. |
| Impact | Signals are consistent and point to a modest, not urgent, priority. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N = 5.3, MEDIUM) describes a remote, unauthenticated, low-complexity information-disclosure flaw with confidentiality-only, limited impact (C:L) and no integrity or availability effect. No EPSS score, CISA KEV listing, or public POC was provided in the input, so exploitation status is: no public exploit identified at time of analysis. There is no SSVC decision data supplied. This is a classic CWE-639 IDOR (user-controlled key / insecure direct object reference) rather than a true authentication bypass despite the 'Authentication Bypass' tag. Net: a legitimately network-reachable, unauthenticated issue that a defender should patch in normal cycles, but the low technical impact (partial read of some objects, no write, no takeover) and lack of any exploitation or weaponization signal keep it well below emergency status. The single Patchstack reference is the only source, so corroboration is thin. |
| Exploit ScenarioDerived | A remote, unauthenticated attacker interacts with a ProfileGrid endpoint and substitutes an object/user identifier (the user-controlled key) that they should not be able to reference, causing the plugin's incorrectly configured access-control level to return data belonging to another user or group. Because PR:N and UI:N apply, this needs no login and no victim interaction, just crafted requests enumerating identifiers. No public proof-of-concept was identified at the time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 01, 2026
Unauthenticated remote attackers can read data that should be access-controlled on WordPress sites running the Metagauss ProfileGrid plugin (profilegrid-user-profiles-groups-and-communities) through version 6.0.0.2 by supplying or guessing an object/user identifier that the plugin fails to validate against the requester's ownership or privileges. The assessed vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) indicates no authentication, privilege, or user interaction is required, but impact is limited to confidentiality (C:L), with the practical constraint that the attacker must know or be able to enumerate a valid identifier. No confirmed active exploitation (KEV) and no public exploit code have been identified from the available data, and the independent assessment rates the overall priority as modest rather than urgent.
RemediationAI
The provided intelligence does not specify an exact patched release, so the primary action is to check the Patchstack advisory and the Metagauss plugin page for the current fixed version and upgrade ProfileGrid past 6.0.0.2 as soon as a remediated release is confirmed - until then, treat 6.0.0.2 and earlier as vulnerable. If the plugin's profile, group, or community features are not in active use, deactivating and removing ProfileGrid eliminates the exposure entirely at the cost of losing those features. Where the plugin must stay enabled, restrict access to its public profile and AJAX/REST endpoints so only expected clients reach them, and consider requiring authentication for profile views; both controls reduce the attack surface but can break legitimate guest-facing profile pages. Because exploitation requires a valid or guessable identifier, add rate limiting and monitoring for anomalous enumeration patterns (sequential or high-volume identifier requests) and deploy WAF rules targeting the plugin's request paths as a compensating control, accepting that signature-based blocking is incomplete against slow enumeration. Applying the WordPress principle of least privilege to accounts and keeping the core, theme, and other plugins patched will not fix this defect but limits secondary impact.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is an instance of CWE-639, Authorization Bypass Through User-Controlled Key - commonly described as an Insecure Direct Object Reference (IDOR). The root cause class is that application logic derives the target object from a client-controlled key (for example a user, group, or community identifier in a request parameter) and returns or acts on that object without first verifying that the current request is permitted to access it. In the WordPress plugin context, this means the plugin exposes a request handler reachable over the network that trusts the caller-supplied identifier instead of resolving the object through a capability or ownership check. The CPE entry cpe:2.3:a:metagauss:profilegrid:*:*:*:*:*:*:*:* uses a wildcard version, indicating that all versions covered by the advisory metadata are considered affected up to and including 6.0.0.2. The assessed CVSS vector is unauthenticated and network-reachable (PR:N/UI:N), which is characteristic of plugin endpoints that are registered for public or AJAX access, and the single-CIA impact profile (C:L only) confirms the vulnerable path discloses data rather than allowing modification or denial of service.
Know when Profilegrid gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Unauthenticated remote IDOR reachable over HTTP (AV:N/AC:L/PR:N/UI:N) yielding partial unauthorized reads only, so C:L with I:N/A:N.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
DescriptionCVE.org
Authorization Bypass Through User-Controlled Key vulnerability in Metagauss ProfileGrid profilegrid-user-profiles-groups-and-communities allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ProfileGrid: from n/a through 6.0.0.2.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
More in Profilegrid
View allImproper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Metagauss ProfileG
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Metagauss ProfileG
The ProfileGrid WordPress plugin before 5.3.1 provides an AJAX endpoint for resetting a user password but does not imple
The profilegrid-user-profiles-groups-and-communities plugin before 2.8.6 for WordPress has remote code execution via an
Privilege escalation in the ProfileGrid WordPress plugin before 5.9.9.8 lets unauthenticated visitors self-register into
Authentication bypass in ProfileGrid WordPress plugin allows unauthenticated attackers to forge PayPal IPN payment notif
The ProfileGrid WordPress plugin before 5.1.1 does not sanitise and escape a parameter before outputting it back in the
Missing authorization checks in ProfileGrid WordPress plugin prior to 5.9.9.7 allow authenticated subscribers to manipul
ProfileGrid WordPress plugin (all versions before 6.0.0.0) exposes group member lists and member identifiers to unauthen
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Metagauss ProfileG
The ProfileGrid - User Profiles, Groups and Communities plugin for WordPress is vulnerable to PHP Object Injection in al
The ProfileGrid - User Profiles, Groups and Communities plugin for WordPress is vulnerable to privilege escalation in al
Exploit-DB