Quick answers
- Is CVE-2026-12687 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-12687 being exploited in the wild.
- How severe is CVE-2026-12687?
- Informational severity, with a CVSS score of 8.1, published 30 July 2026.
- Which products and versions are affected?
- ProfileGrid before 5.9.9.8.
- Is there a fix for CVE-2026-12687?
- A patch was published: Fixed in version 5.9.9.8 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-12687 attacked?
- It is attacked over the network, in a software library.
- Am I affected by CVE-2026-12687?
- Check whether you run ProfileGrid at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The ProfileGrid plugin for WordPress suffers from an unauthenticated privilege escalation vulnerability due to missing authorization checks during the front-end registration process. The plugin does not validate or restrict the 'group ID' parameter provided during registration, allowing an anonymous user to specify a privileged group ID. If a group is configured to grant a high-level WordPress role (such as Administrator), the registrant is automatically assigned that role upon account creation. This allows a remote, unauthenticated attacker to gain full administrative access to the WordPress site. The issue is resolved in version 5.9.9.8.
Affected products
- ProfileGrid ProfileGrid before 5.9.9.8
Timeline
- 2026-07-10: disclosed
- 2026-07-30: advisory: NVD publication date
- patched: Fixed in version 5.9.9.8