CVE-2025-52719: ProfileGrid Information Disclosure Flaw

CVE-2025-52719 Overview

CVE-2025-52719 is an information disclosure vulnerability in the Metagauss ProfileGrid WordPress plugin (profilegrid-user-profiles-groups-and-communities). The flaw affects all versions up to and including 5.9.5.2 and is classified as Exposure of Sensitive System Information to an Unauthorized Control Sphere [CWE-497]. Authenticated users with low privileges can trigger error conditions that expose embedded sensitive data, including full server filesystem paths. This Full Path Disclosure (FPD) issue provides attackers with reconnaissance data useful for chaining further attacks against the WordPress host.

Critical Impact
Authenticated attackers with low privileges can retrieve embedded sensitive system information, including server-side file paths, aiding targeted follow-on exploitation.

Affected Products

Metagauss ProfileGrid plugin for WordPress
profilegrid-user-profiles-groups-and-communities versions up to and including 5.9.5.2
WordPress sites running the vulnerable plugin with authenticated low-privilege accounts

Discovery Timeline

2025-06-20 - CVE-2025-52719 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-52719

Vulnerability Analysis

The ProfileGrid plugin fails to suppress or sanitize PHP error output in certain execution paths. When an authenticated user submits crafted or malformed input to vulnerable plugin endpoints, PHP generates warnings or notices that embed the absolute filesystem path of the WordPress installation. These paths surface in HTTP responses rendered to the requester.

The underlying weakness is mapped to [CWE-497], Exposure of Sensitive System Information to an Unauthorized Control Sphere. The disclosed data does not grant direct code execution but reveals internal configuration details intended to remain hidden. Attackers combine this telemetry with other vulnerabilities, such as local file inclusion or arbitrary file write bugs, to achieve meaningful impact.

Exploitation requires network access and a valid low-privilege account on the target WordPress site. No user interaction beyond the attacker's own authenticated request is needed. The EPSS score is 0.254% at the 15.67 percentile as of October 2026.

Root Cause

The root cause is improper handling of runtime error output within the plugin. Production WordPress deployments should disable display_errors and route PHP notices to logs. The plugin's code paths either rely on verbose error reporting or expose stack-level diagnostic data in responses, leaking the server's installation path (for example /var/www/html/wp-content/plugins/profilegrid-user-profiles-groups-and-communities/...).

Attack Vector

An authenticated attacker holding at least subscriber-level credentials sends crafted HTTP requests to plugin endpoints that trigger PHP errors. The response body returns the full server path embedded in the error output. Because the attack is network-based and requires only low privileges, it is well-suited to opportunistic enumeration against WordPress sites that permit open user registration. See the Patchstack Vulnerability Report for technical details.

Detection Methods for CVE-2025-52719

Indicators of Compromise

HTTP responses from ProfileGrid plugin endpoints containing absolute filesystem paths such as /var/www/, /home/, or C:\inetpub\.
PHP warning or notice strings (Warning:, Notice:, Fatal error:) returned in rendered pages or AJAX responses tied to the plugin.
Repeated authenticated requests to plugin AJAX actions producing HTTP 200 responses with abnormally large or error-laden bodies.

Detection Strategies

Inspect web server access logs for authenticated POST or GET requests targeting ProfileGrid routes followed by anomalous response sizes.
Deploy web application firewall (WAF) signatures that flag PHP error strings leaving the application boundary.
Correlate low-privilege user activity against plugin-specific endpoints to identify reconnaissance behavior.

Monitoring Recommendations

Enable PHP error logging to a protected file and set display_errors = Off in php.ini to confirm errors are no longer rendered to clients.
Monitor newly registered accounts that immediately interact with ProfileGrid endpoints, a common precursor to enumeration.
Alert on outbound HTTP responses containing filesystem path patterns from WordPress hosts.

How to Mitigate CVE-2025-52719

Immediate Actions Required

Upgrade the ProfileGrid plugin to a version later than 5.9.5.2 as soon as the vendor publishes a fixed release.
Audit WordPress user roles and remove or lock any unused low-privilege accounts that could be leveraged for authenticated exploitation.
Set display_errors = Off and log_errors = On across all production PHP configurations to prevent error output from reaching clients.

Patch Information

Metagauss addresses the issue in versions after ProfileGrid 5.9.5.2. Administrators should consult the Patchstack Vulnerability Report for the current fixed version and apply it through the WordPress plugin updater or managed deployment pipeline.

Workarounds

Disable the ProfileGrid plugin until a patched release is installed if authenticated user registration is open to the public.
Deploy WAF rules that strip or block responses containing PHP error strings and filesystem path patterns.
Restrict access to WordPress authenticated endpoints by IP allowlist where business requirements allow.

bash

# Configuration example: disable error display in php.ini
display_errors = Off
display_startup_errors = Off
log_errors = On
error_log = /var/log/php/php_errors.log
error_reporting = E_ALL & ~E_DEPRECATED & ~E_STRICT