CVE-2026-16290
Received Received - Intake

Unauthenticated Group Member Disclosure in ProfileGrid WordPress Plugin

Publication date: 2026-08-06

Last updated on: 2026-08-06

Assigner: WPScan

Description
The ProfileGrid WordPress plugin before 6.0.0.0 does not perform authorization checks before returning a group's member list, and registers the handler for unauthenticated users, allowing any unauthenticated visitor to disclose the members and their identifiers of any group, including private or closed ones, bypassing the ProfileGrid WordPress plugin before 6.0.0.0's member-visibility setting.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-06
Last Modified
2026-08-06
Generated
2026-08-06
AI Q&A
2026-08-06
EPSS Evaluated
N/A
NVD
CVE-2026-16290
EUVD
EUVD-2026-53724

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
profilegrid profilegrid to 6.0.0.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the ProfileGrid WordPress plugin before version 6.0.0.0 allows unauthenticated users to view the member list of any group, including private or closed groups, without proper authorization. The plugin fails to check permissions before returning group member data via the pm_get_all_users_from_group function.

Detection Guidance

To detect this vulnerability, check if your ProfileGrid WordPress plugin version is below 6.0.0.0. You can do this by logging into your WordPress admin panel, navigating to the Plugins section, and looking for the ProfileGrid plugin version. Alternatively, use the command: wp plugin list --name=profilegrid to check the installed version via WP-CLI.

Impact Analysis

This flaw exposes sensitive group membership data to unauthorized users, potentially revealing private user identifiers and group affiliations. Attackers could exploit this to gather information about users in restricted groups without detection.

Compliance Impact

This vulnerability may violate data protection regulations like GDPR and HIPAA by exposing personal or sensitive group membership data without authorization. Organizations could face compliance violations and legal consequences for failing to protect such data.

Mitigation Strategies

Immediately update the ProfileGrid plugin to version 6.0.0.0 or later. This can be done via the WordPress admin panel under Plugins or using the command: wp plugin update profilegrid via WP-CLI. Ensure backups are taken before updating.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-16290. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart