CVE-2026-12688 ProfileGrid < 5.9.9.7 - Unauthenticated Payment Bypass and Forced Group Membership via PayPal IPN Forgery
Unauthenticated attackers can forge PayPal IPN notifications to bypass payment checks and force group membership in ProfileGrid.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-12688?
CVE-2026-12688 is a medium-severity vulnerability in Unknown ProfileGrid, published on 24 Jul 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The ProfileGrid WordPress plugin before 5.9.9.7 does not verify PayPal IPN notifications before granting paid group membership, allowing unauthenticated attackers to forge a payment notification and mark any user as a paid member of any group without any payment being made.
Weakness: CWE-284
Which versions are affected by CVE-2026-12688?
How do I fix CVE-2026-12688?
No fix has been published for CVE-2026-12688 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-12688 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-12688 exists.
Sources
Also known as GHSA-pp2q-mfv3-q5wp.