CVE-2026-16289 in ProfileGrid Plugin
Summary
by MITRE • 08/03/2026
The ProfileGrid WordPress plugin before 6.0.0.0 does not perform authorization checks when listing a group's pending membership requests, allowing any authenticated user such as a Subscriber to disclose the names and request dates of the users awaiting approval to join any group, including private ones.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 08/03/2026
The vulnerability in ProfileGrid WordPress plugin versions prior to 6.0.0.0 represents a critical authorization bypass flaw that undermines the security model of group membership management. This issue stems from insufficient access controls within the plugin's codebase, specifically in the function responsible for retrieving pending membership requests for groups. The flaw allows any authenticated user regardless of their role or permissions level to access sensitive information about users seeking to join groups, including both subscriber names and timestamps of their membership requests.
From a technical perspective, this vulnerability manifests as a lack of proper capability checks within the plugin's backend operations. The affected code fails to verify whether the requesting user possesses appropriate permissions to view pending membership requests for a specific group. This authorization gap exists at the application layer where the plugin should enforce role-based access controls before exposing sensitive data. The flaw falls under CWE-285 which addresses improper authorization issues, and aligns with ATT&CK technique T1078 which covers valid accounts and privilege escalation through unauthorized access to restricted resources.
The operational impact of this vulnerability extends beyond simple information disclosure, as it enables adversaries to gather intelligence about group memberships and user behavior patterns. An attacker with a subscriber account can systematically query various groups to map out membership structures, identify potential targets, and potentially exploit this information for social engineering campaigns or targeted attacks against specific users. The disclosure includes not only user identities but also temporal data that could reveal activity patterns and timing of membership requests, providing valuable context for further exploitation attempts.
Organizations running vulnerable ProfileGrid installations face significant risks including exposure of private group memberships, potential harassment of group members, and compromised privacy of users who may be unaware their requests are being monitored. The vulnerability particularly affects private groups where users expect a higher level of confidentiality in their membership applications. Security practitioners should consider this issue as part of broader access control assessments, ensuring that all plugin components properly validate user permissions before exposing sensitive data.
Mitigation strategies should include immediate upgrade to ProfileGrid version 6.0.0.0 or later, which presumably addresses the authorization flaw through proper capability verification mechanisms. Administrators should also implement additional monitoring for unauthorized access attempts and consider role-based restrictions on group membership request viewing capabilities. The fix should incorporate proper capability checks using WordPress's built-in user role management functions to ensure that only authorized group administrators or moderators can view pending membership requests, thereby preventing unauthorized disclosure of sensitive group membership information across all authenticated user levels.