CVE-2026-12073: ProfileGrid WordPress plugin – account takeover and privilege escalation
The ProfileGrid plugin for WordPress, in all versions up to and including 5.9.9.5, does not validate a registration parameter and mishandles error messages. An unauthenticated attacker could change the email address of account ID 1, usually an administrator, and use that to reset the password. The CVSS 3.1 score is 9.8 (Critical), and no fixed version is identified in the available record.
Overview
The ProfileGrid plugin for WordPress, in all versions up to and including 5.9.9.5, has a flaw in how it handles registration forms. It does not validate a user_login value on forms that lack that parameter and does not handle error messages properly. The record associates the issue with CWE-639, authorization bypass through a user-controlled key.
Impact
The record states that an unauthenticated attacker could change the email address of the account with ID 1, usually an administrator, and then use that change to reset the password and gain access to the account. The CVSS 3.1 base score is 9.8 (Critical), with high impact on confidentiality, integrity and availability.
Affected products and versions
- Product: ProfileGrid – User Profiles, Groups and Communities plugin for WordPress
- Affected range stated in the record: all versions up to and including 5.9.9.5
- Fixed version: not identified in the available record
The structured affected and fixes fields in the record are empty. A changeset on the WordPress plugin repository is referenced, but its content was not available for this analysis.
Exploitation status
The record shows that this CVE is not listed in the CISA KEV catalog. No confirmed active exploitation appears in the sources consulted for this analysis. The EPSS probability in the record is about 0.528%.
Remediation and mitigation
- Check whether ProfileGrid is installed on your WordPress sites and identify the installed version.
- Update to a version later than 5.9.9.5 once the plugin vendor or the WordPress plugin repository confirms a fixed release, since the fixed version is not stated in the available record.
- Until a fix is applied, consider deactivating the plugin on sites where it is not essential, and review whether open user registration is needed.
- Enforce strong, unique passwords and multi-factor authentication for administrator accounts, and verify the email address on administrator accounts.
Detection guidance
- Review recent changes to the account with ID 1, especially email address changes and password reset events.
- Review registration and password reset logs for unusual submissions or repeated errors from unknown sources.
- Check for unexpected new administrator accounts or unexplained privilege changes.
Limitations of the available information
The record does not provide a fixed version, detailed affected-version metadata, or an independent technical analysis of the vulnerable code path. Actual exposure depends on each site's configuration, including whether user ID 1 holds administrator rights and whether registration forms using the plugin are reachable.
Frequently asked questions
Which ProfileGrid versions are affected by CVE-2026-12073?
The record states that all versions up to and including 5.9.9.5 are affected. The fixed version is not identified in the available record.
Why is this vulnerability considered critical?
The CVSS 3.1 base score is 9.8, and the record describes a path where an unauthenticated attacker could take over an account with ID 1, usually an administrator.
Is this CVE known to be actively exploited?
The record shows it is not listed in the CISA KEV catalog, and no confirmed active exploitation appears in the sources consulted.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.