Executive brief
ProfileGrid, a WordPress plugin used for creating user profiles and communities, contains a security flaw in its private messaging system. This vulnerability allows any registered user on the site to interfere with private message threads belonging to other people. Specifically, an attacker can hide messages, mark them as read, or modify message metadata, potentially disrupting communication and damaging the integrity of user interactions.
Technical details
The ProfileGrid plugin for WordPress fails to implement authorization or ownership checks on several AJAX actions related to private messaging, specifically 'pm_messenger_delete_threads' and 'pm_messages_mark_as_read'. An authenticated attacker with Subscriber-level privileges or higher can send crafted requests to these endpoints to soft-delete message threads, modify thread metadata (such as 'delete_mid'), or mark unread messages as read for other users. While the vulnerability does not allow the attacker to read the content of the messages, it permits unauthorized integrity and availability tampering. The issue is fixed in version 5.9.9.7.
Affected products
- ProfileGrid ProfileGrid < 5.9.9.7
Timeline
- 2026-07-03: disclosed: Publicly published by WPScan
- 2026-07-24: advisory: NVD published date