# CVE-2026-12687: ProfileGrid WordPress plugin unauthenticated privilege escalation

Source: https://junglewise.ai/threats/cve-2026-12687-profilegrid-wordpress-plugin-unauthenticated-privilege-escalation  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-30. Updated: 2026-07-30  
License: CC BY 4.0 with a link back

CVE-2026-12687 · Severity: info · CVSS 8.1 · Published 2026-07-30

A vulnerability in the ProfileGrid WordPress plugin, which is used for managing user profiles and communities, allows unauthorized visitors to gain administrative control over a website. By exploiting a flaw in the registration process, an attacker can sign up for a new account and assign themselves to a high-privilege group, such as Administrator. This could lead to a complete takeover of the website, allowing the attacker to steal data, modify content, or lock out legitimate owners.

Technologies: [ProfileGrid](https://junglewise.ai/threats/technologies/profilegrid). Vendors: [ProfileGrid](https://junglewise.ai/threats/vendors/profilegrid).

## Quick answers

**Is CVE-2026-12687 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-12687 being exploited in the wild.

**How severe is CVE-2026-12687?** Informational severity, with a CVSS score of 8.1, published 30 July 2026.

**Which products and versions are affected?** ProfileGrid before 5.9.9.8.

**Is there a fix for CVE-2026-12687?** A patch was published: Fixed in version 5.9.9.8 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-12687 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-12687?** Check whether you run ProfileGrid at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The ProfileGrid plugin for WordPress suffers from an unauthenticated privilege escalation vulnerability due to missing authorization checks during the front-end registration process. The plugin does not validate or restrict the 'group ID' parameter provided during registration, allowing an anonymous user to specify a privileged group ID. If a group is configured to grant a high-level WordPress role (such as Administrator), the registrant is automatically assigned that role upon account creation. This allows a remote, unauthenticated attacker to gain full administrative access to the WordPress site. The issue is resolved in version 5.9.9.8.

## Affected products

- ProfileGrid ProfileGrid before 5.9.9.8

## Timeline

- 2026-07-10: disclosed
- 2026-07-30: advisory: NVD publication date
- patched: Fixed in version 5.9.9.8

## References

- [https://wpscan.com/vulnerability/e754ef68-40ae-4420-a0b8-6c23a83bc450/](https://wpscan.com/vulnerability/e754ef68-40ae-4420-a0b8-6c23a83bc450/)

## Related threats

- [WordPress Frontend Dashboard and ProfileGrid PHP object injection](https://junglewise.ai/threats/cve-2026-103693-the-frontend-dashboard-wordpress-plugin-before-3-0-5-profilegrid)
- [ProfileGrid arbitrary notification deletion via IDOR](https://junglewise.ai/threats/cve-2026-16291-profilegrid-arbitrary-notification-deletion-via-idor)
- [ProfileGrid WordPress plugin missing authorization in license management](https://junglewise.ai/threats/cve-2026-12690-profilegrid-wordpress-plugin-missing-authorization-in-license)
- [ProfileGrid WordPress plugin missing authorization in private messaging](https://junglewise.ai/threats/cve-2026-12689-profilegrid-wordpress-plugin-missing-authorization-in-private)
- [ProfileGrid WordPress plugin payment bypass in PayPal IPN](https://junglewise.ai/threats/cve-2026-12688-profilegrid-wordpress-plugin-payment-bypass-in-paypal-ipn)