CVE-2026-4607 Overview
The ProfileGrid – User Profiles, Groups and Communities plugin for WordPress contains an authorization bypass vulnerability affecting all versions up to and including 5.9.8.4. The plugin fails to verify user authorization in three AJAX action handlers: pm_set_group_order, pm_set_group_items, and pm_set_field_order. Authenticated attackers with Subscriber-level access can modify site-wide ProfileGrid group settings, including group menu order, group list order, group icon display, and field ordering. The vulnerability is classified under [CWE-862] Missing Authorization.
Critical Impact
Subscriber-level users can alter ProfileGrid group configuration affecting all site visitors, disrupting community navigation and content presentation.
Affected Products
- ProfileGrid – User Profiles, Groups and Communities plugin for WordPress
- All versions up to and including 5.9.8.4
- Fixed in changeset 3491679
Discovery Timeline
- 2026-05-13 - CVE CVE-2026-4607 published to NVD
- 2026-05-13 - Last updated in NVD database
Technical Details for CVE-2026-4607
Vulnerability Analysis
The ProfileGrid plugin registers AJAX endpoints to manage group ordering and field ordering from the WordPress admin interface. The handler functions for pm_set_group_order, pm_set_group_items, and pm_set_field_order execute without checking whether the requesting user holds an administrative capability. WordPress AJAX endpoints registered via wp_ajax_{action} are reachable by any authenticated user, including Subscribers, unless the handler enforces capability checks internally.
Because these handlers process input that mutates site-wide configuration state, any logged-in user can issue crafted POST requests to /wp-admin/admin-ajax.php and rewrite settings that affect every visitor. The flaw produces an integrity impact without exposing data confidentiality or causing service disruption.
Root Cause
The handlers referenced in admin/class-profile-magic-admin.php at lines 870, 875, and 880, along with the partial admin/partials/set-groups-order.php, lack calls to current_user_can() or equivalent capability checks. Nonce verification alone, where present, does not prevent authorized low-privilege users from generating valid nonces through normal session activity.
Attack Vector
An attacker registers or authenticates as a Subscriber on a target WordPress site running a vulnerable ProfileGrid version. The attacker then sends a POST request to admin-ajax.php invoking one of the three vulnerable actions with crafted parameters. The plugin processes the request and persists the modified ordering or display state to the database.
The vulnerability mechanism is described in the Wordfence Vulnerability Analysis and the upstream source at the WordPress ProfileGrid Code Review.
Detection Methods for CVE-2026-4607
Indicators of Compromise
- Unexpected POST requests to /wp-admin/admin-ajax.php containing action=pm_set_group_order, action=pm_set_group_items, or action=pm_set_field_order from non-administrator user sessions.
- Unexplained changes to ProfileGrid group order, group menu order, or field order in the WordPress database tables associated with the plugin.
- Subscriber or Contributor accounts generating traffic to ProfileGrid admin AJAX endpoints.
Detection Strategies
- Review web server access logs for admin-ajax.php requests carrying the three vulnerable action names and correlate the originating user ID against the user role.
- Audit ProfileGrid configuration history for changes that do not correspond to administrative activity windows.
- Inspect wp_options and ProfileGrid-specific tables for ordering values that differ from a known-good baseline.
Monitoring Recommendations
- Enable verbose logging of authenticated WordPress AJAX traffic and forward logs to a centralized SIEM.
- Alert on any non-admin role invoking ProfileGrid administrative AJAX actions.
- Track creation rates of new Subscriber accounts on sites running ProfileGrid, particularly where open registration is enabled.
How to Mitigate CVE-2026-4607
Immediate Actions Required
- Update the ProfileGrid plugin to the version released in changeset 3491679 or later.
- Audit existing user accounts and remove unused Subscriber-level accounts created during the exposure window.
- Restore ProfileGrid group ordering and field ordering settings from a trusted backup if tampering is suspected.
Patch Information
The maintainers addressed the authorization bypass in WordPress Plugin Changeset 3491679. The fix introduces proper capability verification within the affected AJAX handlers. Site operators should install the updated release through the WordPress plugin updater.
Workarounds
- Disable the ProfileGrid plugin until the patched version is installed if updates cannot be applied immediately.
- Restrict new user registration to trusted email domains or disable open registration to reduce the pool of potential attackers.
- Apply a web application firewall rule to block requests to admin-ajax.php that specify the three vulnerable action names from sessions lacking administrative cookies.
# Example WAF rule logic to block vulnerable AJAX actions from non-admin sessions
# Block POST requests to admin-ajax.php where action matches the vulnerable handlers
SecRule REQUEST_URI "@endsWith /wp-admin/admin-ajax.php" \
"chain,deny,status:403,id:1026460701,msg:'ProfileGrid CVE-2026-4607 block'"
SecRule ARGS:action "@rx ^(pm_set_group_order|pm_set_group_items|pm_set_field_order)$" \
"chain"
SecRule REQUEST_COOKIES_NAMES "!@rx wordpress_logged_in_admin" "t:none"
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
