# CVE-2026-4607: ProfileGrid WordPress plugin authorization bypass in AJAX actions

Source: https://junglewise.ai/threats/cve-2026-4607-profilegrid-wordpress-plugin-authorization-bypass-in-ajax-actions  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-13. Updated: 2026-05-14  
License: CC BY 4.0 with a link back

CVE-2026-4607 · Severity: medium · CVSS 4.3 · Published 2026-05-13

ProfileGrid, a WordPress plugin used for managing user profiles and community groups, contains a security flaw that allows low-level users to change administrative settings. An attacker with a basic subscriber account can reorder groups, change group icons, and modify how fields are displayed across the entire website. This could lead to unauthorized changes in the site's layout and organization, potentially disrupting the user experience or misrepresenting community structures.

Technologies: [Metagauss ProfileGrid – User Profiles, Groups and Communities](https://junglewise.ai/threats/technologies/profilegrid-user-profiles-groups-and-communities). Vendors: [Metagauss](https://junglewise.ai/threats/vendors/metagauss).

## Quick answers

**Is CVE-2026-4607 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-4607 being exploited in the wild.

**How severe is CVE-2026-4607?** Medium severity, with a CVSS score of 4.3, published 13 May 2026.

**Which products and versions are affected?** Metagauss ProfileGrid – User Profiles, Groups and Communities up to, and including, 5.9.8.4.

**Is there a fix for CVE-2026-4607?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-4607 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-4607?** Check whether you run Metagauss ProfileGrid – User Profiles or Groups and Communities at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The ProfileGrid plugin for WordPress (up to version 5.9.8.4) is vulnerable to a missing authorization check (CWE-862) within several AJAX actions: pm_set_group_order, pm_set_group_items, and pm_set_field_order. The root cause is the plugin's failure to validate that the user requesting these actions has the necessary administrative permissions. An authenticated attacker with Subscriber-level privileges or higher can send crafted AJAX requests to modify site-wide settings, including group menu order, list order, icon displays, and field ordering. A patch appears to be available in version 5.9.8.5 or via the latest changeset.

## Affected products

- ProfileGrid ProfileGrid – User Profiles, Groups and Communities up to, and including, 5.9.8.4

## Timeline

- 2026-05-13: advisory: Advisory published by Wordfence and NVD
- 2026-05-13: disclosed

## References

- [https://plugins.trac.wordpress.org/browser/profilegrid-user-profiles-groups-and-communities/trunk/admin/class-profile-magic-admin.php](https://plugins.trac.wordpress.org/browser/profilegrid-user-profiles-groups-and-communities/trunk/admin/class-profile-magic-admin.php)
- [https://plugins.trac.wordpress.org/browser/profilegrid-user-profiles-groups-and-communities/trunk/admin/class-profile-magic-admin.php](https://plugins.trac.wordpress.org/browser/profilegrid-user-profiles-groups-and-communities/trunk/admin/class-profile-magic-admin.php)
- [https://plugins.trac.wordpress.org/browser/profilegrid-user-profiles-groups-and-communities/trunk/admin/class-profile-magic-admin.php](https://plugins.trac.wordpress.org/browser/profilegrid-user-profiles-groups-and-communities/trunk/admin/class-profile-magic-admin.php)
- [https://plugins.trac.wordpress.org/browser/profilegrid-user-profiles-groups-and-communities/trunk/admin/partials/set-groups-order.php](https://plugins.trac.wordpress.org/browser/profilegrid-user-profiles-groups-and-communities/trunk/admin/partials/set-groups-order.php)
- [https://plugins.trac.wordpress.org/changeset/3491679/](https://plugins.trac.wordpress.org/changeset/3491679/)
- [https://www.wordfence.com/threat-intel/vulnerabilities/id/5f38f9f0-7c15-4c07-b501-b523ea58432a?source=cve](https://www.wordfence.com/threat-intel/vulnerabilities/id/5f38f9f0-7c15-4c07-b501-b523ea58432a?source=cve)

## Related threats

- [Metagauss ProfileGrid privilege escalation via account takeover](https://junglewise.ai/threats/cve-2026-12073-metagauss-profilegrid-privilege-escalation-via-account-takeover)