6.5
Medium
CVE-2026-12688 The ProfileGrid WordPress plugin before 5.9.9.7 does not verify PayPal IPN notifications before granting paid group…
Description
The ProfileGrid WordPress plugin before 5.9.9.7 does not verify PayPal IPN notifications before granting paid group membership, allowing unauthenticated attackers to forge a payment notification and mark any user as a paid member of any group without any payment being made.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| ProfileGrid 5.9 | earliest → < 5.9.9.7 | 5.9.9.7 |
Other CVEs of ProfileGrid
The 9 CVEs of ProfileGrid →
CVE-2026-103693
The Frontend Dashboard WordPress plugin before 3.0.5, ProfileGrid WordPress plugin before 6.0.0.5 do not prevent an…
9.0
Critical
CVE-2026-16290
The ProfileGrid WordPress plugin before 6.0.0.0 does not perform authorization checks before returning a group's member…
5.3
Medium
CVE-2026-16289
The ProfileGrid WordPress plugin before 6.0.0.0 does not perform authorization checks when listing a group's pending…
4.3
Medium
CVE-2026-16291
The ProfileGrid WordPress plugin before 5.9.9.8 does not verify that a notification belongs to the requesting user…
4.3
Medium