Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
6.5
CVE-2026-12688: ProfileGrid WordPress plugin: Unpaid users can join groups.
CVE-2026-12688 · published 3 months ago
Summary
The ProfileGrid WordPress plugin has a security issue that allows anyone to join groups without paying. This is a concern because it lets attackers pretend to pay for group membership. To stay safe, update the ProfileGrid plugin to version 5.9.9.7 or later.
What to do
- Update unknown profilegrid to version 5.9.9.7 or later.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| unknown | profilegrid | < 5.9.9.7 |
Original advisory text
ProfileGrid < 5.9.9.7 - Unauthenticated Payment Bypass and Forced Group Membership via PayPal IPN Forgery
The ProfileGrid WordPress plugin before 5.9.9.7 does not verify PayPal IPN notifications before granting paid group membership, allowing unauthenticated attackers to forge a payment notification and mark any user as a paid member of any group without any payment being made.
Internet-facing
14 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically
- Gives an attacker partial control
Severity
6.5
Medium
Type
CWE-284Improper Access Control
Timeline
Published24 Jul 2026
Updated3 Nov 2026
First seen24 Jul 2026
Track software like this
Free during beta