Back cvefeed.io

CVE-2026-12073 - ProfileGrid - User Profiles, Groups and Communities <=5.9.9.5 - Unauthenticated Privilege Escalation via Email Overwrite Latest Vulnerabilities / 13h CVE ID : CVE-2026-12073 Published : June 30, 2026, 5:34 a.m. 31 minutes ago Description : The ProfileGrid – User Profiles, Groups and Communities plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 5.9.9.5. This is due to the plugin not validating a `user_login` o

cvefeed.io • June 30, 2026

The ProfileGrid – User Profiles, Groups and Communities plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 5.9.9.5. This is due to the plugin not validating a `user_login` on registration forms that don't contain this parameter, and not properly handling the error messages. This makes it possible for unauthenticated attackers to change email address of user account with ID=1 (usually an administrator), and leverage that to reset the user's password and gain access to their account.

The following products are affected by CVE-2026-12073 vulnerability. Even if cvefeed.io is aware of the exact versions of the products that are affected, the information is not represented in the table below.

We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).

Results are limited to the first 15 repositories due to potential performance issues.

The following list is the news that have been mention CVE-2026-12073 vulnerability anywhere in the article.

Results are limited to the first 20 news articles due to potential performance issues.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical Privilege Escalation Vulnerability in ProfileGrid Plugin for WordPress The ProfileGrid – User Profiles, Groups and Communities plugin for WordPress is critically vulnerable to privilege escalation via account takeover, affecting all versions up to and including 5.9.9.5. The vulnerability arises from improper validation of the `user_login` parameter on registration forms, allowing unauthenticated attackers to change the email address of the administrator account (user ID=1) and reset the password. This flaw poses a significant risk as it enables attackers to gain full access to the WordPress administrative account without any authentication. Currently, there is no evidence of public proof-of-concept exploits or active exploitation in the wild. Administrators are advised to update the plugin immediately or disable it until a patch can be applied. The CVSS base score assigned to this vulnerability is 9.8, indicating a critical severity level. The vulnerability was published on June 30, 2026. 1 sources 78

Extracted Entities

The full story

Extracted Entities

Attack Types (1)

CVEs (1)

CWE Weaknesses (1)

Domains (1)

Platforms (1)