CVE-2026-16290 Overview
CVE-2026-16290 is a broken access control vulnerability in the ProfileGrid WordPress plugin versions prior to 6.0.0.0. The plugin fails to perform authorization checks before returning a group's member list. It also registers the request handler for unauthenticated users. Any unauthenticated visitor can enumerate members and their identifiers of any group, including private or closed groups. The flaw bypasses the plugin's member-visibility setting entirely.
Critical Impact
Unauthenticated attackers can disclose group membership data, including member identifiers, from private and closed groups managed by ProfileGrid.
Affected Products
- ProfileGrid WordPress plugin versions prior to 6.0.0.0
Discovery Timeline
- 2026-08-06 - CVE-2026-16290 published to NVD
- 2026-08-06 - Last updated in NVD database
Technical Details for CVE-2026-16290
Vulnerability Analysis
The ProfileGrid plugin exposes an AJAX endpoint that returns group member lists on request. The handler is registered for both authenticated and unauthenticated contexts. This registration pattern makes the endpoint reachable by any anonymous visitor to the WordPress site.
The endpoint does not verify whether the requester has permission to view the requested group's membership. It also disregards the plugin's configured member-visibility setting. As a result, groups marked as private or closed return the same data as public groups. The response includes member identifiers, which can be used to pivot to per-user profile enumeration.
Root Cause
The root cause is missing authorization enforcement on a request handler that returns sensitive membership data. Two design flaws combine to produce the issue. First, the AJAX handler is bound to the unauthenticated action hook. Second, the handler code path omits a capability or membership check before returning results. This maps to broken access control weaknesses in the CWE taxonomy for missing authorization.
Attack Vector
Exploitation requires no authentication and no user interaction. An attacker sends a crafted HTTP request to the WordPress AJAX endpoint used by ProfileGrid, supplying a target group identifier. The server returns the member list for that group regardless of its visibility setting. Attackers can iterate group identifiers to enumerate membership across the entire site. See the WPScan Vulnerability Report for technical details.
Detection Methods for CVE-2026-16290
Indicators of Compromise
- Repeated unauthenticated POST or GET requests to wp-admin/admin-ajax.php containing the ProfileGrid group action parameter
- Sequential enumeration of group identifiers from a single source IP address
- Anomalous volume of AJAX responses returning member identifier arrays to anonymous clients
Detection Strategies
- Review web server access logs for unauthenticated requests targeting ProfileGrid AJAX actions related to group membership
- Alert on requests to admin-ajax.php where the action parameter matches ProfileGrid group handlers and no authentication cookie is present
- Correlate response body sizes against baseline to identify bulk membership disclosure responses
Monitoring Recommendations
- Enable verbose logging on the WordPress application layer, including AJAX action names and requester context
- Deploy a web application firewall rule to flag anonymous access to ProfileGrid group endpoints
- Monitor for scripted access patterns iterating numeric group identifiers over short time windows
How to Mitigate CVE-2026-16290
Immediate Actions Required
- Upgrade the ProfileGrid plugin to version 6.0.0.0 or later on all WordPress sites
- Audit existing groups for sensitive membership data that may have been exposed prior to patching
- Restrict access to admin-ajax.php from untrusted networks where feasible
Patch Information
ProfileGrid version 6.0.0.0 remediates the missing authorization check and removes the unauthenticated handler registration. Refer to the WPScan Vulnerability Report for advisory details and the fixed version identifier.
Workarounds
- Disable the ProfileGrid plugin until the site can be updated to version 6.0.0.0
- Apply web application firewall rules that block unauthenticated requests to ProfileGrid group member AJAX actions
- Remove or restrict private and closed groups containing sensitive membership data until patched
# Example WAF rule pattern to block unauthenticated ProfileGrid group member requests
# Adjust action name to match the vulnerable handler identified in the advisory
SecRule REQUEST_URI "@contains /wp-admin/admin-ajax.php" \
"chain,deny,status:403,id:1026162901,msg:'Block anon ProfileGrid group member enum'"
SecRule ARGS:action "@rx profilegrid_.*group.*member" \
"chain"
SecRule &REQUEST_COOKIES:/wordpress_logged_in_/ "@eq 0"
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
