5.3
Medium
CVE-2026-16290 The ProfileGrid WordPress plugin before 6.0.0.0 does not perform authorization checks before returning a group's member…
Description
The ProfileGrid WordPress plugin before 6.0.0.0 does not perform authorization checks before returning a group's member list, and registers the handler for unauthenticated users, allowing any unauthenticated visitor to disclose the members and their identifiers of any group, including private or closed ones, bypassing the ProfileGrid WordPress plugin before 6.0.0.0's member-visibility setting.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| ProfileGrid 6.0 | earliest → < 6.0.0.0 | 6.0.0.0 |
Other CVEs of ProfileGrid
The 9 CVEs of ProfileGrid →
CVE-2026-103693
The Frontend Dashboard WordPress plugin before 3.0.5, ProfileGrid WordPress plugin before 6.0.0.5 do not prevent an…
9.0
Critical
CVE-2026-16289
The ProfileGrid WordPress plugin before 6.0.0.0 does not perform authorization checks when listing a group's pending…
4.3
Medium
CVE-2026-16291
The ProfileGrid WordPress plugin before 5.9.9.8 does not verify that a notification belongs to the requesting user…
4.3
Medium
CVE-2026-12687
The ProfileGrid WordPress plugin before 5.9.9.8 does not restrict which group an anonymous visitor may register into…
7.5
High