CVE-2026-12073 - Exploits & Severity

The ProfileGrid – User Profiles, Groups and Communities plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 5.9.9.5. The plugin fails to validate the `user_login` parameter on registration forms that don't contain this field and doesn't properly handle error messages. This allows attackers to change the email address of the user account with ID=1 (typically an administrator) and subsequently reset that user's password to gain account access.

An unauthenticated attacker over the network can change the email address of the administrator account (user ID=1), reset the administrator's password, and gain full access to the WordPress administrative account.

There is no evidence that a public proof-of-concept exists. There is no evidence of proof of exploitation at the moment.

Update the ProfileGrid plugin to a version newer than 5.9.9.5 immediately. If an immediate update is not possible, consider disabling the plugin until patching can be completed, as this vulnerability allows direct compromise of administrator accounts without requiring any authentication.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Feedly found the first article mentioning CVE-2026-12073 . See article

NVD published the first details for CVE-2026-12073

A CVSS base score of 9.8 has been assigned.

GitHub Advisories released a security advisory .

The ProfileGrid plugin for WordPress is critically vulnerable to privilege escalation, allowing unauthenticated attackers to change the email address of the primary user account (typically an administrator) and reset the password to gain access. The vulnerability arises from improper validation of the `user_login` parameter in registration forms, and there are no details provided regarding exploitation in the wild, proof-of-concept exploits, mitigations, or patches. The severity is noted as 0.0, indicating a lack of immediate threat assessment or urgency. See article

[GHSA-5949-6pq3-mp7g] The ProfileGrid – User Profiles, Groups and Communities plugin for WordPress is

CVE-2026-12073 - ProfileGrid - User Profiles, Groups and Communities <=5.9.9.5 - Unauthenticated Privilege Escalation via Email Overwrite

CVE-2026-12073 - Exploits & Severity - Feedly

[GHSA-5949-6pq3-mp7g] The ProfileGrid – User Profiles, Groups and Communities plugin for WordPress is

Collect, analyze, and vulnerability reports faster using AI