high7.5
CVE-2026-12687
The ProfileGrid WordPress plugin before 5.9.9.8 does not restrict which group an anonymous visitor may register into through its front-end registration, allowi…
Impact
The ProfileGrid WordPress plugin before 5.9.9.8 does not restrict which group an anonymous visitor may register into through its front-end registration, allowing unauthenticated users to register directly into a privileged group and be granted that group's configured role, up to Administrator when such a group exists, leading to privilege escalation.
Affected products
| Product | Affected versions |
|---|---|
| ProfileGrid WordPress Plugin | before 5.9.9.8 |
Versions were read from the advisory text. No structured product data has been published for this record yet.