CVE-2026-12689

5.4 Moyenne

Publiée le 24/07/2026 à 09:16 · Modifiée le 24/07/2026 à 22:48 · Analyse NVD reportée · Source : contact@wpscan.com

Description

The ProfileGrid WordPress plugin before 5.9.9.7 does not perform any authorization or ownership check on some of its private-message thread actions, allowing authenticated users with Subscriber-level access and above to soft-delete, tamper with the metadata of, and mark as read other users' private message threads.

Traduire en français

Produits concernés

Unknown ProfileGrid

Scores CVSS

Version	Score	Source	Vecteur
3.1	5.4 Moyenne	134c704f-9b21-4f2e-91b3-4a467353bcc0	`CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N`

Faiblesses (CWE)

CWE-862

Références

https://wpscan.com/vulnerability/7368fe32-9415-47c3-b94b-b85ca1a0d101/

Ailleurs

NVD
CVE.org
CIRCL Vulnerability-Lookup
CERT-FR
GitHub Advisories