ProfileGrid – User Profiles, Groups and Communities <= 6.0.0.5 - Authenticated (Subscriber+) Insecure Direct Object Reference to Arbitrary User Profile Field Disclosure via 'user_id' Parameter
- ID
- WPSEC-2026-1729
- Plugin
- ProfileGrid – User Profiles, Groups and Communities (profilegrid-user-profiles-groups-and-communities)
- Affected
- all versions before 6.0.0.6
- Remediation
- Update to 6.0.0.6 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
- Weakness
- CWE-639
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-10-27
- Attack surface
- ProfileGrid – User Profiles, Groups and Communities on WPSec AttackSurface
- Fix released
- Published
Description
The ProfileGrid – User Profiles, Groups and Communities plugin for WordPress is vulnerable to Insecure Direct Object Reference via the front-end edit-profile view of the profile page in all versions up to, and including, 6.0.0.5. This is due to the plugin opening the edit-profile form for the user named in the 'user_id' parameter whenever the current user leads the group given in the 'gid' parameter, without checking that the target user belongs to that group. This makes it possible for authenticated attackers with Subscriber-level access and above who have been made manager (leader) of any group to view the stored profile field values of any user on the site, including users outside their group and users whose profiles are restricted.
References
- https://wpsec.com/vuln/WPSEC-2026-1729/
- https://plugins.svn.wordpress.org/profilegrid-user-profiles-groups-and-communities/tags/6.0.0.6/
- https://wordpress.org/plugins/profilegrid-user-profiles-groups-and-communities/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS