# CVE-2026-12690: ProfileGrid WordPress plugin missing authorization in license management

Source: https://junglewise.ai/threats/cve-2026-12690-profilegrid-wordpress-plugin-missing-authorization-in-license  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-24. Updated: 2026-07-24  
License: CC BY 4.0 with a link back

CVE-2026-12690 · Severity: info · CVSS 4.3 · Published 2026-07-24

ProfileGrid, a WordPress plugin used for creating user profiles and communities, contains a security flaw in its license management system. This vulnerability allows any logged-in user, including those with low-level 'Subscriber' accounts, to modify or deactivate the website's premium license settings. This could lead to a loss of premium features, disruption of site functionality, and potential administrative headaches for site owners.

Technologies: [ProfileGrid](https://junglewise.ai/threats/technologies/profilegrid). Vendors: [ProfileGrid](https://junglewise.ai/threats/vendors/profilegrid).

## Quick answers

**Is CVE-2026-12690 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-12690 being exploited in the wild.

**How severe is CVE-2026-12690?** Informational severity, with a CVSS score of 4.3, published 24 July 2026.

**Which products and versions are affected?** ProfileGrid < 5.9.9.7.

**Is there a fix for CVE-2026-12690?** A patch was published on 2026-07-24: Fixed in version 5.9.9.7 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-12690 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-12690?** Check whether you run ProfileGrid at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The ProfileGrid plugin for WordPress fails to implement proper authorization checks (CWE-862) on its AJAX-based license management actions. While the plugin uses a nonce for security, this nonce is exposed to all logged-in users on every administrative page. An authenticated attacker with Subscriber-level privileges can retrieve this nonce and send crafted requests to the 'pg_deactivate_license' or 'pg_activate_license' actions. This allows the attacker to overwrite the 'pg_premium_license_key' and related options, effectively deactivating premium features or injecting arbitrary values into specific namespaced license options. The vulnerability is fixed in version 5.9.9.7.

## Affected products

- ProfileGrid ProfileGrid < 5.9.9.7

## Timeline

- 2026-07-03: disclosed: Initial public disclosure by WPScan
- 2026-07-24: advisory: NVD publication date
- 2026-07-24: patched: Fixed in version 5.9.9.7

## References

- [https://wpscan.com/vulnerability/7a1fc208-851b-4eb6-a332-fbef57181755/](https://wpscan.com/vulnerability/7a1fc208-851b-4eb6-a332-fbef57181755/)

## Related threats

- [WordPress Frontend Dashboard and ProfileGrid PHP object injection](https://junglewise.ai/threats/cve-2026-103693-the-frontend-dashboard-wordpress-plugin-before-3-0-5-profilegrid)
- [ProfileGrid arbitrary notification deletion via IDOR](https://junglewise.ai/threats/cve-2026-16291-profilegrid-arbitrary-notification-deletion-via-idor)
- [ProfileGrid WordPress plugin unauthenticated privilege escalation](https://junglewise.ai/threats/cve-2026-12687-profilegrid-wordpress-plugin-unauthenticated-privilege-escalation)
- [ProfileGrid WordPress plugin missing authorization in private messaging](https://junglewise.ai/threats/cve-2026-12689-profilegrid-wordpress-plugin-missing-authorization-in-private)
- [ProfileGrid WordPress plugin payment bypass in PayPal IPN](https://junglewise.ai/threats/cve-2026-12688-profilegrid-wordpress-plugin-payment-bypass-in-paypal-ipn)