CVE-2026-12687 ProfileGrid < 5.9.9.8 - Unauthenticated Privilege Escalation via Unrestricted Group ID
Unauthenticated attackers can register into privileged groups to gain Administrator access in ProfileGrid WordPress plugin.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-12687?
CVE-2026-12687 is a high-severity vulnerability in Unknown ProfileGrid, published on 30 Jul 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The ProfileGrid WordPress plugin before 5.9.9.8 does not restrict which group an anonymous visitor may register into through its front-end registration, allowing unauthenticated users to register directly into a privileged group and be granted that group's configured role, up to Administrator when such a group exists, leading to privilege escalation.
Weakness: CWE-269
Which versions are affected by CVE-2026-12687?
How do I fix CVE-2026-12687?
No fix has been published for CVE-2026-12687 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-12687 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-12687 exists.
Sources
Also known as GHSA-9fxw-6x9j-x2gr.