{
 "id": "WPSEC-2026-1729",
 "url": "https://wpsec.com/vuln/WPSEC-2026-1729/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-1729/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1729/index.md",
 "title": "ProfileGrid – User Profiles, Groups and Communities <= 6.0.0.5 - Authenticated (Subscriber+) Insecure Direct Object Reference to Arbitrary User Profile Field Disclosure via 'user_id' Parameter",
 "description": "The ProfileGrid – User Profiles, Groups and Communities plugin for WordPress is vulnerable to Insecure Direct Object Reference via the front-end edit-profile view of the profile page in all versions up to, and including, 6.0.0.5. This is due to the plugin opening the edit-profile form for the user named in the 'user_id' parameter whenever the current user leads the group given in the 'gid' parameter, without checking that the target user belongs to that group. This makes it possible for authenticated attackers with Subscriber-level access and above who have been made manager (leader) of any group to view the stored profile field values of any user on the site, including users outside their group and users whose profiles are restricted.",
 "plugin": {
  "slug": "profilegrid-user-profiles-groups-and-communities",
  "name": "ProfileGrid – User Profiles, Groups and Communities",
  "full_name": "ProfileGrid – User Profiles, Groups and Communities",
  "wordpress_org": "https://wordpress.org/plugins/profilegrid-user-profiles-groups-and-communities/",
  "advisories_url": "https://wpsec.com/vuln/plugin/profilegrid-user-profiles-groups-and-communities/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/profilegrid-user-profiles-groups-and-communities"
 },
 "type": "IDOR",
 "cwe": [
  "CWE-639"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 4.3,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "6.0.0.6",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 6.0.0.6"
  ]
 },
 "introduced_in": null,
 "fixed_in": "6.0.0.6",
 "remediation": "Update to 6.0.0.6 or later.",
 "fix_released": "2026-10-26T11:31:45+00:00",
 "published": "2026-10-27T11:50:51+00:00",
 "updated": "2026-10-26T13:21:05.916093+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-1729/",
  "https://plugins.svn.wordpress.org/profilegrid-user-profiles-groups-and-communities/tags/6.0.0.6/",
  "https://wordpress.org/plugins/profilegrid-user-profiles-groups-and-communities/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/profilegrid-user-profiles-groups-and-communities",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "Low",
  "as_of": "2026-10-27"
 }
}