Is CVE-2026-57697 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-57697 being exploited in the wild.

How severe is CVE-2026-57697?

High severity, with a CVSS score of 7.5, published 13 July 2026.

Which products and versions are affected?

Metagauss ProfileGrid - User Profiles, Groups and Communities <= 5.9.9.6.

Is there a fix for CVE-2026-57697?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-57697 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-57697?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-57697: Metagauss ProfileGrid authentication bypass in password recovery

Q: Is there a fix for CVE-2026-57697?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

Q: How is CVE-2026-57697 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-57697?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-57697 · Severity: high · CVSS 7.5 · Published 2026-07-13

Metagauss ProfileGrid is a WordPress plugin used to manage user profiles, memberships, and online communities. A security flaw in the plugin's authentication system allows unauthorized individuals to bypass security checks during the password recovery process. This could allow an attacker to gain unauthorized access to user accounts, potentially leading to a full takeover of the website if administrative accounts are targeted.

Quick answers

Is CVE-2026-57697 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-57697 being exploited in the wild.
How severe is CVE-2026-57697?: High severity, with a CVSS score of 7.5, published 13 July 2026.
Which products and versions are affected?: Metagauss ProfileGrid - User Profiles, Groups and Communities <= 5.9.9.6.
Is there a fix for CVE-2026-57697?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-57697 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-57697?: Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An Authentication Bypass Using an Alternate Path or Channel (CWE-288) exists in the Metagauss ProfileGrid plugin through version 5.9.9.6. The vulnerability resides in the password recovery logic, where insufficient validation allows an attacker to bypass standard authentication requirements. An unauthenticated remote attacker can exploit this flaw to reset passwords or gain unauthorized access to accounts. The issue is resolved in version 5.9.9.7.

Affected products

Metagauss ProfileGrid - User Profiles, Groups and Communities <= 5.9.9.6

Timeline

2026-05-18: other: Vulnerability reported by Jakub Herman
2026-07-08: advisory: Patchstack advisory published
2026-07-13: disclosed: CVE published to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.