Executive brief
The ProfileGrid plugin for WordPress, which manages user profiles and community groups, contains a critical security flaw that allows unauthorized individuals to take over administrator accounts. By exploiting a weakness in how the plugin handles registration forms, an attacker can change the email address associated with the site's primary administrator. This allows the attacker to reset the administrator's password, gain full control of the website, and potentially access sensitive user data or disrupt operations.
Technical details
The ProfileGrid plugin for WordPress is vulnerable to an authorization bypass (CWE-639) leading to privilege escalation in versions up to 5.9.9.5. The root cause is a failure to validate the 'user_login' parameter on registration forms that do not explicitly include it, combined with improper error message handling. An unauthenticated remote attacker can exploit this to modify the email address of the user account with ID 1 (typically the site administrator). Once the email is changed, the attacker can use the standard WordPress password reset functionality to gain full access to the administrative account. A fix appears to be available in the plugin's development track (changeset 3578435).
Affected products
- Metagauss ProfileGrid – User Profiles, Groups and Communities up to, and including, 5.9.9.5
Timeline
- 2026-06-30: disclosed
- 2026-06-30: advisory