What is the CVSS score of EUVD-2026-29953?

EUVD-2026-29953 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

ProfileGrid User Profiles EUVD-2026-29953

| CVE-2026-4608 MEDIUM

SQL Injection (CWE-89)

2026-05-13 Wordfence

SQLi WordPress

6.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

May 13, 2026 - 14:45 vuln.today

CVE Published

May 13, 2026 - 13:27 nvd

MEDIUM 6.5

DescriptionCVE.org

The ProfileGrid - User Profiles, Groups and Communities plugin for WordPress is vulnerable to blind SQL Injection via the 'rid' parameter in all versions up to, and including, 5.9.8.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

AnalysisAI

ProfileGrid User Profiles plugin for WordPress versions up to 5.9.8.4 allow authenticated attackers with Subscriber-level access to execute blind SQL injection attacks via the 'rid' parameter due to insufficient input escaping and lack of prepared statement use. The vulnerability enables extraction of sensitive database information without user interaction. No public exploit code or active exploitation has been confirmed at this time.

Technical ContextAI

The vulnerability exists in the ProfileGrid plugin's handling of the 'rid' parameter, which is processed by SQL query construction in multiple handler classes (class-profile-magic-public.php, class-profile-magic-request.php, and class-profile-magic-dbhandler.php). The root cause is CWE-89 (SQL Injection) - the plugin constructs dynamic SQL queries by concatenating user-supplied input without proper parameterization via prepared statements or sufficient escaping mechanisms. The attack surface is accessible to any authenticated WordPress user at Subscriber level or higher, making this a relatively low-barrier vulnerability despite requiring initial authentication.

RemediationAI

Update ProfileGrid to version 5.9.8.5 or later immediately, as the plugin maintainers released a patched version (confirmed by changeset 3491679 in the WordPress plugin repository). For sites unable to update immediately, disable public user registration via WordPress admin settings (Settings → General → Membership) to restrict the attack surface to administrator-created accounts only. Alternatively, restrict Subscriber-level access permissions using role management plugins or community-specific settings within ProfileGrid. Monitor database query logs for unusual SQL patterns in the 'rid' parameter. If compromise is suspected, audit user accounts for unauthorized access and run a full database integrity scan. These mitigations carry trade-offs: disabling registration impacts user community features, and restricting roles may limit plugin functionality.