CVE-2026-94663: WordPress ProfileGrid plugin <= 6.0.0.2 - SQL Injection vulnerability

Q: Which installations are affected?

ProfileGrid versions through 6.0.0.2 are affected. The affected product is Metagauss ProfileGrid, also identified as profilegrid-user-profiles-groups-and-communities.

Q: What level of access does an attacker need?

The CVSS vector indicates that an attacker needs low privileges (PR:L) and can exploit the issue remotely over the network (AV:N). No user interaction is required (UI:N), and attack complexity is low (AC:L).

Q: What could exploitation allow?

The vulnerability allows blind SQL injection. The supplied vector indicates high confidentiality impact, no integrity impact, and low availability impact, with scope changed.

Published Oct 9, 2026

Updated

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Metagauss ProfileGrid profilegrid-user-profiles-groups-and-communities allows Blind SQL Injection.This issue affects ProfileGrid: from n/a through 6.0.0.2.

Affected Software

1 affected component

Metagauss ProfileGrid<=6.0.0.2

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade WordPress ProfileGrid plugin to a version that resolves this vulnerability.
Fixed in 6.0.0.3

Event History

Oct 9, 2026

CVE Published

via MITRE·10:00 AM

Data Sourced

via MITRE·10:00 AM

RemedyDescriptionSeverityWeakness

Frequently Asked Questions

Which installations are affected?

ProfileGrid versions through 6.0.0.2 are affected. The affected product is Metagauss ProfileGrid, also identified as profilegrid-user-profiles-groups-and-communities.

What level of access does an attacker need?

The CVSS vector indicates that an attacker needs low privileges (PR:L) and can exploit the issue remotely over the network (AV:N). No user interaction is required (UI:N), and attack complexity is low (AC:L).

What could exploitation allow?

The vulnerability allows blind SQL injection. The supplied vector indicates high confidentiality impact, no integrity impact, and low availability impact, with scope changed.

CVE-2026-94663: WordPress ProfileGrid plugin <= 6.0.0.2 - SQL Injection vulnerability

Affected Software

Remediation

Event History

Frequently Asked Questions

Which installations are affected?

What level of access does an attacker need?

What could exploitation allow?

Company

Resources

Contact

Frequently Asked Questions

Which installations are affected?

What level of access does an attacker need?

What could exploitation allow?