ProfileGrid <6.0.0.0 Vulnerability: Broken Access Control Leading to User Data Disclosure via CVE-2026-16289

Vulnerability Overview Vulnerability Name: ProfileGrid < 6.0.0.0 - Subscriber+ Group Join Request Disclosure via pm_get_all_requests_from_group Description: The plugin fails to perform an authorization check when listing pending membership requests for groups, allowing any authenticated user (such as a subscriber) to disclose the names and request dates of users waiting for approval to join any group, including private group requests. CVE Number: CVE-2026-16289 Classification: - Type: NO AUTHORISATION - OWASP Top 10: A5: Broken Access Control - CWE: CWE-862 - CVSS: 4.3 (medium) Affected Versions Affected Plugin: profilegrid-user-profiles-groups-and-communities Fixed Version: 6.0.0.0 Remediation Fixed Version: Upgrade to version 6.0.0.0 or later. Timeline Public Disclosure Date: 2026-07-24 Date Added: 2026-07-24 Last Updated: 2026-07-24 Additional Information Original Researcher: Meher Sudhakar Abbireddi Submitter: Meher Sudhakar Abbireddi Verification Status: Yes WPVDB ID: 815a2245-6477-42a1-b08a-fa308a830be3 Related Vulnerabilities PegaPoll <= 1.0.2 - Unauthenticated Arbitrary Options Update (2024-10-25) Blog2Social: Social Media Auto Post & Scheduler < 8.9.1 - Missing Authorization to Authenticated (Subscriber+) Delete Arbitrary B2B Post Records via 'postid' Parameter (2026-05-12) Motors - Car Dealership & Classified Listings Plugin < 1.4.104 - Missing Authorization to Authenticated (Subscriber+) Payment Bypass via 'stm_payment_status' Parameter (2026-05-11) ReviewX - Multi-Criteria Reviews for WooCommerce with Google Reviews & Schema < 2.3.7 - Missing Authorization (2026-04-22) Arconix Shortcodes < 2.1.12 - Missing Authorization (2024-07-19) POC Code

Goal Reached Thanks to every supporter — we hit 100%!

ProfileGrid <6.0.0.0 Vulnerability: Broken Access Control Leading to User Data Disclosure via CVE-2026-16289

More from this source