Summary
CVE-2026-12687 is a high-severity improper privilege management vulnerability (CWE-269) in the ProfileGrid – User Profiles, Groups and Communities WordPress plugin, developed by Metagauss, affecting all versions before 5.9.9.8. The flaw allows unauthenticated remote attackers to register directly into any group — including groups configured with the WordPress Administrator role — through the plugin’s front-end registration form, bypassing all group access restrictions. On sites where an Administrator-level group exists, this results in full unauthenticated privilege escalation to WordPress Administrator.
Technical details
- Root cause: The plugin does not validate or restrict the group ID parameter submitted during front-end user registration. An anonymous visitor can supply an arbitrary group ID, including that of a privileged group, and be registered into it without any authorization check.
- Trigger conditions: Full escalation to Administrator requires that at least one ProfileGrid group has been configured with the WordPress Administrator role. Sites using privileged groups for membership tiers, staff access, or community management are at elevated risk.
- Attack vector: Remote, unauthenticated. An attacker needs only to submit a crafted registration request over the network — no credentials, prior access, or user interaction required.
- Impact: An attacker who successfully registers into an Administrator-configured group is immediately granted WordPress Administrator privileges, enabling full site takeover, arbitrary code execution, content modification, credential harvesting, and persistent backdoor installation.
Affected software
- ProfileGrid – User Profiles, Groups and Communities (WordPress plugin) — all versions prior to 5.9.9.8
Severity
- CVSS v3.1 Base Score: 7.5 (HIGH)
- Vector String:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Note: The official CVSS vector reflects high Confidentiality impact but does not score Integrity or Availability impact. Given that successful exploitation can yield full WordPress Administrator access — including the ability to modify all site content, install plugins, and execute server-side code — the practical impact of this vulnerability extends beyond what the base score reflects.
Mitigation and recommended actions
- Immediate action: Update the ProfileGrid plugin to version 5.9.9.8 or later. This version adds server-side validation to restrict group assignment during front-end registration.
- If immediate patching is not possible:
- Audit all ProfileGrid group configurations and temporarily remove the Administrator role from any group accessible via front-end registration.
- Consider disabling front-end registration through ProfileGrid until the plugin is updated.
- Monitor new user registrations for unexpected role assignments (Administrator, Editor) originating from the ProfileGrid registration flow.
IONIX Status
The IONIX research team is tracking ongoing exploitation attempts and recommends immediate patching. Potentially affected assets are outlined in this post.