CVE-2026-12688: ProfileGrid < 5.9.9.7 - Unauthenticated Payment Bypass and Forced Group Membership via PayPal IPN Forgery
Published Jul 24, 2026
·Updated
The ProfileGrid WordPress plugin before 5.9.9.7 does not verify PayPal IPN notifications before granting paid group membership, allowing unauthenticated attackers to forge a payment notification and mark any user as a paid member of any group without any payment being made.
Affected Software
1 affected component
ProfileGrid WordPress plugin<5.9.9.7
Event History
Jul 24, 2026
CVE Published
via MITRE·06:00 AM
Data Sourced
via MITRE·06:00 AM
DescriptionWeakness
Data Sourced
via NVD·07:16 AM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What is the severity of CVE-2026-12688?
CVE-2026-12688 has a medium severity score of 6.5 according to CVSS 3.1.
2
How do I fix CVE-2026-12688?
To fix CVE-2026-12688, update the ProfileGrid WordPress plugin to version 5.9.9.7 or later.
3
What does CVE-2026-12688 exploit in the ProfileGrid plugin?
CVE-2026-12688 exploits the lack of verification for PayPal IPN notifications, allowing payment bypass.
4
Who is affected by CVE-2026-12688?
Any site using the ProfileGrid WordPress plugin prior to version 5.9.9.7 is affected by CVE-2026-12688.
5
What are the consequences of CVE-2026-12688?
CVE-2026-12688 allows unauthenticated attackers to grant paid group memberships without actual payment.