CVE-2026-4609: ProfileGrid WordPress Auth Bypass Flaw

CVE-2026-4609 Overview

CVE-2026-4609 is a missing authorization vulnerability in the ProfileGrid – User Profiles, Groups and Communities plugin for WordPress. The flaw affects all versions up to and including 5.9.8.4. The pm_invite_user function lacks a capability check, allowing authenticated users with Subscriber-level access or higher to add themselves or any registered user to any ProfileGrid group. This includes closed and paid groups, bypassing both authorization and payment gates. The issue is tracked under CWE-862: Missing Authorization.

Critical Impact
Authenticated low-privilege users can join closed and paid groups without authorization or payment, undermining access control and monetization for any site using the plugin.

Affected Products

ProfileGrid – User Profiles, Groups and Communities plugin for WordPress
All versions up to and including 5.9.8.4
WordPress sites monetizing access through ProfileGrid paid groups

Discovery Timeline

2026-05-13 - CVE-2026-4609 published to NVD
2026-05-13 - Last updated in NVD database

Technical Details for CVE-2026-4609

Vulnerability Analysis

The ProfileGrid plugin exposes a pm_invite_user function intended to allow group administrators to invite users into ProfileGrid groups. The function is reachable by any authenticated user but does not verify whether the caller has the capability to manage group membership. As a result, a Subscriber-level account can invoke the action and add arbitrary user IDs, including their own, into any group on the site.

The impact extends beyond casual social groups. ProfileGrid supports closed groups requiring approval and paid groups gated by purchase. Because the function performs the membership write without consulting group privacy settings or payment status, attackers receive the same access as legitimate paying members. This breaks content gating, membership revenue, and access control assumptions enforced elsewhere in the plugin.

Root Cause

The root cause is the absence of a current_user_can() capability check and the absence of a group-context authorization check inside pm_invite_user. The handler trusts request parameters identifying the target user and group, then writes the membership directly. Patched code is available in WordPress changeset #3491679, with the original vulnerable handler referenced in the plugin source at class-profile-magic-public.php line 3280 and line 3319.

Attack Vector

Exploitation requires a valid WordPress account at Subscriber level or above. The attacker sends an authenticated request to the ProfileGrid AJAX endpoint invoking pm_invite_user with a chosen group_id and user_id. The server processes the request, creates the membership record, and the attacker gains the privileges of a group member. No user interaction from an administrator is required. See the Wordfence Vulnerability Report for additional context.

Detection Methods for CVE-2026-4609

Indicators of Compromise

Unexpected membership records in ProfileGrid group tables for users who did not pay or were not approved
Subscriber accounts appearing in closed or paid groups without corresponding order or invitation records
Sudden spikes in successful POST requests referencing the pm_invite_user action
Access logs showing the same low-privilege user joining multiple groups in a short window

Detection Strategies

Audit the ProfileGrid group membership tables and reconcile entries against payment and invitation records
Inspect web server access logs for admin-ajax.php requests with action=pm_invite_user originating from non-admin sessions
Correlate WordPress user role data with group membership to flag Subscribers in restricted groups
Monitor for repeated AJAX requests to ProfileGrid endpoints from a single authenticated session

Monitoring Recommendations

Enable WordPress audit logging to capture role changes and group membership writes
Forward web server and PHP error logs to a centralized analytics platform for correlation
Alert on any ProfileGrid membership insert performed by a user without the matching group-admin capability
Track ecommerce reconciliation gaps between paid group memberships and order records

How to Mitigate CVE-2026-4609

Immediate Actions Required

Update the ProfileGrid – User Profiles, Groups and Communities plugin to the version released in changeset #3491679 or later
Review existing group memberships and remove unauthorized entries from closed and paid groups
Force password resets for Subscriber accounts that show anomalous group activity
Reconcile paid group access against order records and revoke unpaid access

Patch Information

The vendor addressed the issue in the ProfileGrid plugin via WordPress.org changeset #3491679. The fix adds the missing authorization check to the pm_invite_user handler. Site operators should upgrade beyond version 5.9.8.4 to a release containing this changeset.

Workarounds

Deactivate the ProfileGrid plugin until the patched version can be installed if paid or closed groups are in use
Restrict access to admin-ajax.php requests with action=pm_invite_user at the web application firewall layer
Temporarily downgrade open registration to admin-approved registration to reduce the population of Subscriber accounts that could exploit the flaw

bash

# Example WAF rule to block unauthenticated/Subscriber abuse of the vulnerable action
# Drop POSTs to admin-ajax.php carrying action=pm_invite_user until patched
SecRule REQUEST_METHOD "@streq POST" \
  "chain,phase:2,deny,status:403,id:1004609,msg:'Block CVE-2026-4609 pm_invite_user'"
  SecRule REQUEST_URI "@endsWith /wp-admin/admin-ajax.php" "chain"
  SecRule ARGS:action "@streq pm_invite_user"