Executive brief
ProfileGrid, a WordPress plugin used for creating user profiles and communities, contains a security flaw in its license management system. This vulnerability allows any logged-in user, including those with low-level 'Subscriber' accounts, to modify or deactivate the website's premium license settings. This could lead to a loss of premium features, disruption of site functionality, and potential administrative headaches for site owners.
Technical details
The ProfileGrid plugin for WordPress fails to implement proper authorization checks (CWE-862) on its AJAX-based license management actions. While the plugin uses a nonce for security, this nonce is exposed to all logged-in users on every administrative page. An authenticated attacker with Subscriber-level privileges can retrieve this nonce and send crafted requests to the 'pg_deactivate_license' or 'pg_activate_license' actions. This allows the attacker to overwrite the 'pg_premium_license_key' and related options, effectively deactivating premium features or injecting arbitrary values into specific namespaced license options. The vulnerability is fixed in version 5.9.9.7.
Affected products
- ProfileGrid ProfileGrid < 5.9.9.7
Timeline
- 2026-07-03: disclosed: Initial public disclosure by WPScan
- 2026-07-24: advisory: NVD publication date
- 2026-07-24: patched: Fixed in version 5.9.9.7