CVE-2026-4608: ProfileGrid WordPress Plugin SQLi Flaw

CVE-2026-4608 Overview

CVE-2026-4608 is a blind SQL injection vulnerability in the ProfileGrid – User Profiles, Groups and Communities plugin for WordPress. The flaw affects all versions up to and including 5.9.8.4. The vulnerability stems from insufficient escaping of the user-supplied rid parameter and the lack of proper preparation on the existing SQL query. Authenticated attackers with Subscriber-level access or above can append SQL queries to existing statements and extract sensitive data from the WordPress database. The issue is tracked under CWE-89 (Improper Neutralization of Special Elements used in an SQL Command).

Critical Impact

Authenticated Subscriber-level attackers can extract sensitive data, including user credentials and session tokens, from the WordPress database via blind SQL injection.

Affected Products

• ProfileGrid – User Profiles, Groups and Communities plugin for WordPress
• All versions through and including 5.9.8.4
• Any WordPress site allowing Subscriber-level registration with the affected plugin enabled

Discovery Timeline

• 2026-05-13 - CVE-2026-4608 published to NVD
• 2026-05-13 - Last updated in NVD database

Technical Details for CVE-2026-4608

Vulnerability Analysis

The ProfileGrid plugin uses the rid parameter in multiple database query paths without sufficient sanitization or use of prepared statements. Attackers authenticated as Subscribers can manipulate the parameter to inject arbitrary SQL fragments. Because the injection is blind, attackers infer query results from differences in server response or timing rather than direct output. Successful exploitation enables exfiltration of user records, password hashes, session metadata, and other sensitive table contents.

Root Cause

The root cause is improper neutralization of input passed to dynamic SQL statements within the plugin's request and database handler classes. The affected code paths reside in class-profile-magic-dbhandler.php, class-profile-magic-request.php, and class-profile-magic-public.php. These locations interpolate the rid value directly into SQL queries without using $wpdb->prepare() with proper placeholders. Reference: WordPress Plugin Code Snippet (dbhandler L192) and WordPress Plugin Code Snippet (public L4755).

Attack Vector

The attack vector is network-based and requires only low-privilege authentication. An attacker registers a Subscriber account on a target WordPress site, then issues crafted requests to plugin endpoints that consume the rid parameter. The injected SQL payload is appended to the original query, allowing boolean-based or time-based blind data extraction. No user interaction is required beyond the attacker's own authenticated session.

// No verified public exploit code is available.
// See the Wordfence advisory and patch changeset for technical details:
// https://www.wordfence.com/threat-intel/vulnerabilities/id/3f58ed72-5a0b-4b43-ad76-7730c79741da
// https://plugins.trac.wordpress.org/changeset/3491679/

Detection Methods for CVE-2026-4608

Indicators of Compromise

• Web server access logs containing SQL syntax fragments such as UNION, SLEEP(, BENCHMARK(, or -- in the rid query parameter
• Unusually slow responses from ProfileGrid plugin endpoints, consistent with time-based blind SQL injection
• Newly created Subscriber accounts that generate large volumes of requests to ProfileGrid URLs
• Database error entries or unexpected query patterns in WordPress and MySQL logs

Detection Strategies

• Inspect HTTP request logs for repeated parameter manipulation of rid from a single authenticated session
• Deploy a Web Application Firewall (WAF) rule set that flags SQL keywords inside the rid parameter
• Correlate WordPress user registration events with subsequent plugin endpoint access patterns
• Audit the WordPress database for unauthorized reads of wp_users and wp_usermeta via query logging

Monitoring Recommendations

• Enable MySQL general query logging or slow query logging on sites running ProfileGrid versions ≤ 5.9.8.4
• Monitor for spikes in 500-series HTTP responses from ProfileGrid endpoints
• Track Subscriber-level account creation rates and correlate with subsequent plugin activity
• Alert on outbound data transfer anomalies originating from the WordPress host

How to Mitigate CVE-2026-4608

Immediate Actions Required

• Update the ProfileGrid – User Profiles, Groups and Communities plugin to a version newer than 5.9.8.4 that contains the fix from WordPress Changeset #3491679
• Audit existing Subscriber and higher-privileged accounts for unfamiliar registrations
• Rotate WordPress administrator passwords and invalidate active sessions if compromise is suspected
• Review database access logs for suspicious queries targeting user and session tables

Patch Information

The vendor addressed the issue in WordPress Changeset #3491679, which introduces proper input handling and prepared statements for the rid parameter. Detailed analysis is available in the Wordfence Vulnerability Analysis. Site administrators should apply the update through the WordPress plugin dashboard or via WP-CLI.

Workarounds

• Disable the ProfileGrid plugin until the patched version is installed
• Restrict new user registration on the WordPress site to prevent untrusted Subscriber-level accounts
• Deploy a WAF rule that blocks non-numeric values in the rid request parameter
• Apply least-privilege database credentials to the WordPress wp-config.php user to limit data exposure

# Update ProfileGrid via WP-CLI to the patched release
wp plugin update profilegrid-user-profiles-groups-and-communities

# Verify the installed version is greater than 5.9.8.4
wp plugin get profilegrid-user-profiles-groups-and-communities --field=version

# Temporary workaround: deactivate the plugin until patched
wp plugin deactivate profilegrid-user-profiles-groups-and-communities