Security Alert Summary
The ProfileGrid – User Profiles, Groups and Communities plugin for WordPress contains a missing capability check in the pm_invite_user function. In affected versions up to and including 5.9.8.4, authenticated users with Subscriber-level access and above can add themselves or any registered user to any ProfileGrid group, including closed and paid groups, bypassing authorization and payment controls.
CVE Details
- CVE ID: CVE-2026-4609
- Affected component: ProfileGrid – User Profiles, Groups and Communities plugin for WordPress
- Affected versions: All versions up to, and including, 5.9.8.4
- Published: May 13, 2026 2:17:58 PM
- Last modified: May 13, 2026 2:43:46 PM
- CVSS v3.1: Base Score 7.1, Severity HIGH, Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N
- Authentication / Privileges / Interaction:
- Privileges Required: LOW (an authenticated user, e.g., Subscriber-level)
- User Interaction: NONE
- Attack Vector: NETWORK; Attack Complexity: LOW; Scope: UNCHANGED
- Primary impact: Confidentiality: LOW; Integrity: HIGH; Availability: NONE
- Weakness: CWE-862 (Missing Authorization)
Technical Details
The vulnerability is a missing capability check on the pm_invite_user function. Because the function does not verify that the calling user has the required authorization to add members, an authenticated user with low privileges can trigger group membership changes.
Specifically, the lack of an authorization check in the invitation logic allows an attacker with Subscriber-level access or higher to add themselves or any existing registered user to any ProfileGrid group. This includes closed and paid groups, allowing membership changes that bypass authorization and payment gates.
The impact is limited to the functionality controlled by the vulnerable code path: group membership can be modified without proper checks. The vulnerability does not, based on the provided information, indicate arbitrary code execution or full site takeover.
How This Could Impact Your Website
Consider a small site with multiple users: the site owner configures closed groups for members, an internal editor manages content and user roles, and an external contractor or contributor has Subscriber-level access for commenting or limited tasks. An attacker who gains access to a Subscriber account or exploits an account belonging to a contractor could add that account or other registered users into closed or paid groups.
Practical consequences include unauthorized access to member-only content and resources, and the potential exposure of internal user metadata tied to group membership. Even though confidentiality impact is listed as LOW, group membership changes can reveal or consolidate user information that increases the risk of targeted phishing or social engineering against staff or contributors.
If youre unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review.
Recommended Actions
- Update the affected plugin as soon as a patched version is available.
- Review and reduce unnecessary user roles, especially accounts with Contributor or higher privileges.
- Enforce strong passwords and two-factor authentication for editors and administrators.
- Remove unused or unmaintained plugins.
- Monitor site activity and logs for unusual behavior related to group membership changes or unexpected user role modifications.
If youd like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.
References
- https://plugins.trac.wordpress.org/browser/profilegrid-user-profiles-groups-and-communities/trunk/public/class-profile-magic-public.php#L3280
- https://plugins.trac.wordpress.org/browser/profilegrid-user-profiles-groups-and-communities/trunk/public/class-profile-magic-public.php#L3319
- https://plugins.trac.wordpress.org/changeset/3491679/
- https://www.wordfence.com/threat-intel/vulnerabilities/id/c3678b4d-0cd0-4873-8cf3-90c557931f4c?source=cve
