ProfileGrid User Profiles EUVD-2026-29953

Exploitation requires: (1) authenticated user account at WordPress Subscriber level or higher on the target site, (2) the ProfileGrid plugin installed and active (versions 5.9.8.4 and below), (3) access to endpoints or functionality that process the 'rid' parameter (primarily in profile or request handling). Non-default configuration or feature enablement is not explicitly stated as a requirement. The vulnerability is NOT dependent on specific WordPress security plugins being disabled or site configuration beyond standard WordPress setup. However, if a site blocks user registration entirely, the attack surface is limited to administrator-created accounts or sites with pre-existing users.

CVSS 6.5 (Medium-High) with network vector, low complexity, and low privilege requirements indicates moderate real-world risk. The vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N confirms attackers need WordPress user authentication but no elevated privileges, no user interaction, and can achieve high confidentiality impact (database read access) without modifying data or denying service. However, the blind SQL injection nature means exploitation requires iterative probing, reducing practical exploitation speed compared to error-based injection. The authentication requirement (PR:L) is a significant limiting factor - attackers must first obtain or create a Subscriber account, though many WordPress sites allow public registration. No KEV listing, no POC availability, and no EPSS data were provided; this suggests exploitation is not yet widespread or automated, but the vulnerability is straightforward enough that private exploitation by competitors or motivated threat actors is plausible. Real-world risk depends heavily on whether the target WordPress site allows public user registration and the sensitivity of database content.

An attacker creates a Subscriber-level account on a WordPress site running ProfileGrid 5.9.8.4 or earlier. The attacker crafts requests with malicious SQL in the 'rid' parameter, using blind SQL injection techniques (conditional delays or response-based inference) to systematically extract data from the WordPress database tables, such as user credentials, email addresses, or private user profile information. Since no user interaction is required, the attack can proceed programmatically without detection.