CVE-2026-4609: ProfileGrid <= 5.9.8.4 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Group Joining
The ProfileGrid – User Profiles, Groups and Communities plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the pminviteuser function in all versions up to, and including, 5.9.8.4. This makes it possible for authenticated attackers, with Subscriber-level access and above, to add themselves or any registered user to any ProfileGrid group, including closed and paid groups, bypassing all authorization and payment gates.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-4609?
CVE-2026-4609 is considered a medium severity vulnerability due to its potential for unauthorized access to user groups.
How do I fix CVE-2026-4609?
To fix CVE-2026-4609, it is recommended to update the ProfileGrid plugin to the latest version that includes the necessary capability checks.
What version of ProfileGrid is affected by CVE-2026-4609?
CVE-2026-4609 affects all versions of ProfileGrid up to and including version 5.9.8.4.
What is the main issue caused by CVE-2026-4609?
The main issue with CVE-2026-4609 is the missing authorization check that allows authenticated users to join arbitrary groups without proper permissions.
Who is impacted by CVE-2026-4609?
Users of the ProfileGrid plugin for WordPress who have version 5.9.8.4 or earlier installed are impacted by CVE-2026-4609.