# CVE-2026-12073: Metagauss ProfileGrid privilege escalation via account takeover

Source: https://junglewise.ai/threats/cve-2026-12073-metagauss-profilegrid-privilege-escalation-via-account-takeover  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-30. Updated: 2026-06-30  
License: CC BY 4.0 with a link back

CVE-2026-12073 · Severity: critical · CVSS 9.8 · Published 2026-06-30

The ProfileGrid plugin for WordPress, which manages user profiles and community groups, contains a critical security flaw that allows unauthorized individuals to take over administrator accounts. By exploiting a weakness in how the plugin handles registration forms, an attacker can change the email address associated with the site's primary administrator. This allows the attacker to reset the administrator's password, gain full control of the website, and potentially access sensitive user data or disrupt operations.

Technologies: [Metagauss ProfileGrid – User Profiles, Groups and Communities](https://junglewise.ai/threats/technologies/profilegrid-user-profiles-groups-and-communities). Vendors: [Metagauss](https://junglewise.ai/threats/vendors/metagauss).

## Quick answers

**Is CVE-2026-12073 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-12073 being exploited in the wild.

**How severe is CVE-2026-12073?** Critical severity, with a CVSS score of 9.8, published 30 June 2026.

**Which products and versions are affected?** Metagauss ProfileGrid – User Profiles, Groups and Communities up to, and including, 5.9.9.5.

**Is there a fix for CVE-2026-12073?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-12073 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-12073?** Check whether you run Metagauss ProfileGrid – User Profiles or Groups and Communities at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The ProfileGrid plugin for WordPress is vulnerable to an authorization bypass (CWE-639) leading to privilege escalation in versions up to 5.9.9.5. The root cause is a failure to validate the 'user_login' parameter on registration forms that do not explicitly include it, combined with improper error message handling. An unauthenticated remote attacker can exploit this to modify the email address of the user account with ID 1 (typically the site administrator). Once the email is changed, the attacker can use the standard WordPress password reset functionality to gain full access to the administrative account. A fix appears to be available in the plugin's development track (changeset 3578435).

## Affected products

- Metagauss ProfileGrid – User Profiles, Groups and Communities up to, and including, 5.9.9.5

## Timeline

- 2026-06-30: disclosed
- 2026-06-30: advisory

## References

- [https://plugins.trac.wordpress.org/changeset/3578435/](https://plugins.trac.wordpress.org/changeset/3578435/)
- [https://www.wordfence.com/threat-intel/vulnerabilities/id/2d35279d-299e-4ca2-8f84-165284e058c8?source=cve](https://www.wordfence.com/threat-intel/vulnerabilities/id/2d35279d-299e-4ca2-8f84-165284e058c8?source=cve)

## Related threats

- [ProfileGrid WordPress plugin authorization bypass in AJAX actions](https://junglewise.ai/threats/cve-2026-4607-profilegrid-wordpress-plugin-authorization-bypass-in-ajax-actions)