CVE-2026-16289 Overview
CVE-2026-16289 is a missing authorization vulnerability [CWE-862] in the ProfileGrid WordPress plugin before version 6.0.0.0. The plugin fails to perform authorization checks when listing a group's pending membership requests. Any authenticated user, including low-privilege Subscribers, can disclose the names and request dates of users awaiting approval to join any group, including private groups.
The issue exposes user information that group administrators intended to keep confidential. Exploitation requires only a valid low-privilege account and network access to the target WordPress site.
Critical Impact
Authenticated attackers with Subscriber-level access can enumerate names and request timestamps of users seeking membership in any ProfileGrid group, including private ones.
Affected Products
- ProfileGrid WordPress plugin versions prior to 6.0.0.0
- WordPress sites using ProfileGrid with group membership features enabled
- Private and public ProfileGrid groups configured for approval-based membership
Discovery Timeline
- 2026-08-03 - CVE-2026-16289 published to NVD
- 2026-08-03 - Last updated in NVD database
Technical Details for CVE-2026-16289
Vulnerability Analysis
The vulnerability resides in the ProfileGrid endpoint responsible for returning a group's pending membership requests. The endpoint verifies that the requester is authenticated but does not confirm the requester is a group owner, moderator, or administrator. As a result, any logged-in user can invoke the endpoint and retrieve pending request data for arbitrary groups.
The disclosed data includes usernames and the timestamps of pending join requests. For private groups, this information reveals membership intent that should not be visible outside the group's leadership. Attackers can enumerate group identifiers to harvest data across the entire site.
This flaw is categorized as Missing Authorization [CWE-862]. It affects confidentiality only; integrity and availability are not directly impacted. The EPSS probability at publication was approximately 0.16%.
Root Cause
The root cause is the absence of a capability or role check inside the AJAX handler that lists pending membership requests. The code path relies on authentication alone and does not validate that the caller has group-management privileges over the target group identifier submitted in the request.
Attack Vector
An attacker authenticates to the target WordPress instance using any account, including a self-registered Subscriber. The attacker then issues a request to the ProfileGrid pending-requests endpoint, supplying the group ID of interest. The server returns the pending user list without validating authorization.
See the WPScan Vulnerability Advisory for endpoint-level technical detail.
Detection Methods for CVE-2026-16289
Indicators of Compromise
- Unexpected authenticated AJAX requests to ProfileGrid endpoints handling group membership requests from low-privilege user accounts.
- Repeated requests iterating through sequential group IDs from a single account or IP address.
- Access to pending-request data by users who are not group owners or administrators.
Detection Strategies
- Review WordPress access logs for admin-ajax.php or REST calls referencing ProfileGrid group membership actions initiated by Subscriber-level accounts.
- Correlate authenticated session activity with group-management actions to identify users acting outside their assigned role.
- Alert on enumeration patterns where a single account queries many distinct group identifiers in a short window.
Monitoring Recommendations
- Enable verbose logging on the WordPress instance and forward events to a centralized log platform for retention and analysis.
- Monitor newly registered accounts that immediately interact with plugin AJAX endpoints.
- Track anomalous response sizes from ProfileGrid endpoints that may indicate bulk data disclosure.
How to Mitigate CVE-2026-16289
Immediate Actions Required
- Upgrade the ProfileGrid plugin to version 6.0.0.0 or later on all affected WordPress sites.
- Audit existing user accounts and remove unused or unknown Subscriber-level accounts.
- Review recent access logs for signs of pending-request enumeration prior to patching.
Patch Information
The vendor addressed the issue in ProfileGrid version 6.0.0.0. Administrators should update through the WordPress plugin management interface or by deploying the updated plugin package. Refer to the WPScan Vulnerability Advisory for advisory details.
Workarounds
- Disable the ProfileGrid plugin until the update to 6.0.0.0 can be applied.
- Restrict new user registration on the site to reduce the pool of accounts that could exploit the endpoint.
- Place the WordPress admin and AJAX endpoints behind a web application firewall rule that blocks unauthorized calls to ProfileGrid group-request actions.
# Configuration example: disable open registration in wp-config.php context
wp option update users_can_register 0
wp plugin update profilegrid-user-profiles-groups-and-communities --version=6.0.0.0
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
