CVE-2026-62061: ProfileGrid Auth Bypass Vulnerability

CVE-2026-62061 Overview

CVE-2026-62061 is an Insecure Direct Object Reference (IDOR) vulnerability in the Metagauss ProfileGrid WordPress plugin (profilegrid-user-profiles-groups-and-communities). The flaw is classified as Authorization Bypass Through User-Controlled Key [CWE-639]. It affects all versions from the initial release through 6.0.0.2.

An unauthenticated attacker can manipulate user-controlled identifiers in requests to access resources that should be restricted. The vulnerability stems from incorrectly configured access control checks that trust client-supplied object references without verifying the requester's authorization.

Critical Impact

Remote, unauthenticated attackers can read restricted profile or object data belonging to other users of a ProfileGrid-enabled WordPress site.

Affected Products

• Metagauss ProfileGrid plugin for WordPress
• Plugin slug: profilegrid-user-profiles-groups-and-communities
• All versions from n/a through 6.0.0.2

Discovery Timeline

• 2026-10-01 - CVE-2026-62061 published to the National Vulnerability Database
• 2026-10-01 - Last updated in NVD database

Technical Details for CVE-2026-62061

Vulnerability Analysis

The vulnerability resides in request handlers within the ProfileGrid plugin that accept object identifiers from client input. These handlers fetch and return data based on the supplied identifier without validating that the requester owns or is permitted to view the referenced object.

Because the attack vector is the network and no authentication or user interaction is required, the issue is exploitable with a single crafted HTTP request. The scope impact is limited to confidentiality; the flaw does not directly allow modification or destruction of data.

Authorization Bypass Through User-Controlled Key is a classic access control weakness in which the server trusts a parameter such as a user ID, profile ID, or group ID. By incrementing or substituting these identifiers, an attacker enumerates and retrieves data belonging to other accounts.

Root Cause

The root cause is missing object-level authorization in ProfileGrid request handlers. The code uses user-supplied keys to look up records in the database but does not confirm that the current session or request context is authorized to access the referenced resource. This mapping of CWE-639 occurs when authorization decisions rely on parameters an attacker fully controls.

Attack Vector

An attacker sends crafted HTTP requests to ProfileGrid endpoints while substituting identifier parameters. The server returns data for the referenced object regardless of the attacker's identity. Automated scripts can iterate identifiers to harvest profile data at scale. See the Patchstack IDOR Vulnerability Report for additional technical context.

No verified proof-of-concept code is available. The vulnerability mechanism is described above without synthetic exploit code.

Detection Methods for CVE-2026-62061

Indicators of Compromise

• Sequential or enumerated identifier values in query strings or POST bodies targeting ProfileGrid endpoints
• Repeated requests from a single source accessing many distinct profile or group IDs in a short time window
• Unauthenticated requests returning HTTP 200 responses containing other users' profile data

Detection Strategies

• Review web server and WordPress access logs for high-volume requests to ProfileGrid plugin routes with varying ID parameters
• Correlate response sizes and status codes to identify successful unauthorized data retrievals
• Deploy a web application firewall rule that flags unauthenticated access to ProfileGrid endpoints returning user-scoped data

Monitoring Recommendations

• Enable verbose request logging for /wp-admin/admin-ajax.php and ProfileGrid REST routes
• Alert on anomalous enumeration patterns against user, profile, and group identifier parameters
• Monitor outbound data transfer sizes from the WordPress host for signs of scraping activity

How to Mitigate CVE-2026-62061

Immediate Actions Required

• Identify all WordPress installations running the ProfileGrid plugin at version 6.0.0.2 or earlier
• Restrict public access to ProfileGrid endpoints at the WAF or reverse proxy until a patched version is deployed
• Audit access logs for prior enumeration activity against ProfileGrid identifier parameters

Patch Information

At the time of publication, consult the Patchstack advisory for the current fixed version. Administrators should upgrade to any ProfileGrid release later than 6.0.0.2 that specifically addresses CVE-2026-62061.

Workarounds

• Disable the ProfileGrid plugin if an upgrade cannot be applied immediately
• Use a virtual patching rule in a web application firewall to block requests containing ProfileGrid identifier parameters from unauthenticated sessions
• Restrict access to ProfileGrid-related URLs by IP allowlist where feasible

# Example ModSecurity-style rule to block unauthenticated access to ProfileGrid AJAX actions
SecRule REQUEST_URI "@contains /wp-admin/admin-ajax.php" \
  "chain,phase:2,deny,status:403,id:1026062061,msg:'Block unauthenticated ProfileGrid IDOR attempts'"
  SecRule ARGS:action "@beginsWith pm_" \
    "chain"
    SecRule &REQUEST_COOKIES:/wordpress_logged_in_/ "@eq 0"