CVE-2026-4609

7.1 Élevée

Publiée le 13/05/2026 à 16:17 · Modifiée le 17/06/2026 à 12:56 · Analyse NVD reportée · Source : security@wordfence.com

Description

The ProfileGrid – User Profiles, Groups and Communities plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the pm_invite_user function in all versions up to, and including, 5.9.8.4. This makes it possible for authenticated attackers, with Subscriber-level access and above, to add themselves or any registered user to any ProfileGrid group, including closed and paid groups, bypassing all authorization and payment gates.

Traduire en français

Produits concernés

metagauss ProfileGrid – User Profiles, Groups and Communities

Scores CVSS

Version	Score	Source	Vecteur
3.1	7.1 Élevée	security@wordfence.com	`CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N`

Faiblesses (CWE)

CWE-862

Références

https://plugins.trac.wordpress.org/browser/profilegrid-user-profiles-groups-and-communities/trunk/public/class-profile-magic-public.php#L3280
https://plugins.trac.wordpress.org/browser/profilegrid-user-profiles-groups-and-communities/trunk/public/class-profile-magic-public.php#L3319
https://plugins.trac.wordpress.org/changeset/3491679/
https://www.wordfence.com/threat-intel/vulnerabilities/id/c3678b4d-0cd0-4873-8cf3-90c557931f4c?source=cve

Ailleurs

NVD
CVE.org
CIRCL Vulnerability-Lookup
CERT-FR
GitHub Advisories