Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
8.8

ProfileGrid plugin lets attacker run code remotely

CVE-2019-15873 · published 7 years ago
Summary

The ProfileGrid User Profiles, Groups and Communities plugin for WordPress, versions before 2.8.6, can be tricked into executing any code an attacker sends through a special admin‑ajax request. This could let a remote user take control of your website or steal data. Update the plugin to version 2.8.6 or later, or remove it if you’re not using it.

What to do
  • Update metagauss profilegrid to version 2.8.6 or later.
Affected software
VendorProductAffected versions
metagauss profilegrid < 2.8.6
cpe:2.3:a:metagauss:profilegrid:*:*:*:*:*:wordpress:*:*
Original advisory text
The profilegrid-user-profiles-groups-and-communities plugin before 2.8.6 for WordPress has remote code execution via an wp-admin/admin-ajax.php request with the action=pm_template_preview&html=<?ph...
The profilegrid-user-profiles-groups-and-communities plugin before 2.8.6 for WordPress has remote code execution via an wp-admin/admin-ajax.php request with the action=pm_template_preview&html=<?php substring followed by PHP code.
References
Fix within
Internet-facing 14 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit (estimated)
  • Gives an attacker full control (estimated)
Severity
8.8 High
Exploitation
4% chance of attack within 30 days
Type
CWE-94Code Injection
Timeline
Published3 Sep 2019
Updated24 Oct 2026
First seen29 Sep 2026
Sources
CVE-2019-15873 · NVD
Track software like this
Free during beta