Junglewise Threat Intelligence

CVE-2026-4607: ProfileGrid WordPress plugin authorization bypass in AJAX actions

CVE-2026-4607 · Severity: medium · CVSS 4.3 · Published 2026-05-13

Technologies: Metagauss ProfileGrid – User Profiles, Groups and Communities. Vendors: Metagauss, ProfileGrid.

Executive brief

ProfileGrid, a WordPress plugin used for managing user profiles and community groups, contains a security flaw that allows low-level users to change administrative settings. An attacker with a basic subscriber account can reorder groups, change group icons, and modify how fields are displayed across the entire website. This could lead to unauthorized changes in the site's layout and organization, potentially disrupting the user experience or misrepresenting community structures.

Technical details

The ProfileGrid plugin for WordPress (up to version 5.9.8.4) is vulnerable to a missing authorization check (CWE-862) within several AJAX actions: pm_set_group_order, pm_set_group_items, and pm_set_field_order. The root cause is the plugin's failure to validate that the user requesting these actions has the necessary administrative permissions. An authenticated attacker with Subscriber-level privileges or higher can send crafted AJAX requests to modify site-wide settings, including group menu order, list order, icon displays, and field ordering. A patch appears to be available in version 5.9.8.5 or via the latest changeset.

Affected products

  • ProfileGrid ProfileGrid – User Profiles, Groups and Communities up to, and including, 5.9.8.4

Timeline

  • 2026-05-13: advisory: Advisory published by Wordfence and NVD
  • 2026-05-13: disclosed

References

Related threats