ProfileGrid EUVD-2026-95619

Exploitation requires the ProfileGrid plugin (versions through 6.0.0.2) installed and active on a WordPress site, and a low-privilege authenticated session (CVSS PR:L) - typically satisfied because ProfileGrid is a user-profile/community plugin that commonly permits self-registration, lowering the authentication barrier. No user interaction is needed (UI:N) and the attack is network-reachable (AV:N) with low complexity (AC:L). The exact vulnerable feature/endpoint and parameter are not specified in the available data, so defenders cannot pin the trigger to a named setting; the primary limiting factor is the need for at least minimal authenticated access and the plugin being present, meaning sites that disable open registration materially raise the bar for attackers.

This is a CWE-89 blind SQL injection in the Metagauss ProfileGrid WordPress plugin, reported by Patchstack with a CVSS 3.1 base score of 8.5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L). The vector signals a network-reachable, low-complexity attack requiring low privileges (PR:L) and no user interaction, with a changed scope and high confidentiality impact - consistent with an authenticated user (e.g., a registered community member/subscriber) extracting data from the WordPress database. No EPSS score, CISA KEV entry, SSVC decision data, or public POC was supplied in the input, so there is no evidence of active exploitation: this should currently be treated as no public exploit identified at time of analysis. The practical risk is driven by the low privilege bar - ProfileGrid is a community/registration plugin whose entire purpose is to let users self-register, so PR:L is often trivially satisfied, raising real-world risk above what the 'authenticated' label might suggest. The CVSS I:N/A:L combination fits blind SQLi (primarily read-oriented), but blind SQLi can often be escalated to fuller database disclosure; the S:C (scope change) assertion is plausible for a WordPress plugin that can reach the shared database but is not independently verifiable from the single reference. Net: a genuine high-priority patch item for sites running this plugin with open registration, not merely a high-CVSS-but-low-risk issue, though the absence of EPSS/KEV/POC means widespread automated exploitation is not yet demonstrated.

An attacker registers (or uses an existing low-privilege) account on a WordPress site running ProfileGrid ≤ 6.0.0.2, then sends a crafted request to a vulnerable plugin endpoint whose parameter is concatenated into an SQL query. Because the flaw is blind, the attacker infers results via boolean/time-based responses to progressively dump sensitive data such as user credentials, session tokens, or other table contents. No public POC was provided in the input, and the low attack complexity (AC:L) with no user interaction (UI:N) makes the injection straightforward to automate once an authenticated session exists.