CVE-2026-4608: SQL Injection in ProfileGrid WordPress Plugin
Platform
wordpress
Component
profilegrid-user-profiles-groups-and-communities
Fixed in
5.9.8.5
CVE-2026-4608 describes a blind SQL Injection vulnerability discovered in the ProfileGrid WordPress plugin, a tool for user profiles, groups, and communities. This flaw allows authenticated attackers, even those with Subscriber-level access, to inject malicious SQL queries. The vulnerability impacts versions up to 5.9.8.4, and a patch is available in version 5.9.8.5.
Detect this CVE in your project
Upload your dependency file and we'll tell you instantly if this and other CVEs hit you.
Impact and Attack Scenarios
An attacker exploiting this SQL Injection vulnerability can potentially extract sensitive information stored within the WordPress database. While the vulnerability requires authentication (Subscriber level or higher), the ease of access makes it a significant risk. Successful exploitation could lead to the theft of user credentials, personal data, configuration details, or even database schema information. The impact is amplified if the database contains sensitive data like financial information or personally identifiable information (PII). This vulnerability shares similarities with other SQL Injection attacks where attackers can bypass security controls and gain unauthorized access to data.
Exploitation Context
CVE-2026-4608 was published on May 13, 2026. The vulnerability’s severity is currently assessed as medium. There is no indication of this CVE being listed on KEV or having an EPSS score. Public Proof-of-Concept (POC) exploits are currently unknown, but the ease of exploitation makes it a potential target for opportunistic attackers. Monitor WordPress plugin directories and security forums for any emerging exploitation attempts.
Threat Intelligence
Exploit Status
CVSS Vector
What do these metrics mean?
- Attack Vector
- Network — remotely exploitable over the internet. No physical or local access required. Widest attack surface.
- Attack Complexity
- Low — no special conditions required. Attacker can exploit reliably without depending on rare configurations or timing.
- Privileges Required
- Low — any valid user account is sufficient. Basic authenticated access required.
- User Interaction
- None — attack is automatic and silent. Victim does nothing: no click, no file open.
- Scope
- Unchanged — impact is limited to the vulnerable component itself.
- Confidentiality
- High — complete confidentiality loss. Attacker can read all data: credentials, keys, personal data.
- Integrity
- None — no integrity impact. Attacker cannot modify data.
- Availability
- None — no availability impact. Service remains fully operational.
Affected Software
Weakness Classification (CWE)
Timeline
- Published
Mitigation and Workarounds
The primary mitigation for CVE-2026-4608 is to immediately upgrade the ProfileGrid plugin to version 5.9.8.5 or later. If upgrading is not immediately feasible due to compatibility issues or breaking changes, consider implementing a Web Application Firewall (WAF) rule to filter out suspicious SQL queries targeting the 'rid' parameter. Specifically, look for unusual characters or SQL keywords within the parameter value. Additionally, review and harden database user permissions to limit the potential damage from a successful SQL Injection attack. After upgrading, confirm the fix by attempting a SQL Injection attack on the 'rid' parameter and verifying that it is properly sanitized.
How to fix
Update to version 5.9.8.5, or a newer patched version
Frequently asked questions
What is CVE-2026-4608 — SQL Injection in ProfileGrid WordPress Plugin?
CVE-2026-4608 is a medium severity SQL Injection vulnerability affecting the ProfileGrid WordPress plugin versions 0–5.9.8.4, allowing authenticated attackers to extract sensitive data.
Am I affected by CVE-2026-4608 in ProfileGrid WordPress Plugin?
If you are using ProfileGrid WordPress plugin versions 0 through 5.9.8.4, you are potentially affected by this vulnerability. Upgrade immediately.
How do I fix CVE-2026-4608 in ProfileGrid WordPress Plugin?
Upgrade the ProfileGrid plugin to version 5.9.8.5 or later. If immediate upgrade is not possible, implement WAF rules to filter suspicious SQL queries.
Is CVE-2026-4608 being actively exploited?
There are currently no known active campaigns exploiting CVE-2026-4608, but the ease of exploitation makes it a potential target.
Where can I find the official ProfileGrid advisory for CVE-2026-4608?
Refer to the ProfileGrid website and WordPress plugin repository for the official advisory and update information.
Is your project affected?
Upload your dependency file and we'll tell you instantly if this and other CVEs hit you.
Detect this CVE in your project
Upload your dependency file and we'll tell you instantly if this and other CVEs hit you.
Scan your WordPress project now — no account
Upload any manifest (composer.lock, package-lock.json, WordPress plugin list…) or paste your component list. You get a vulnerability report instantly. Uploading a file is just the start: with an account you get continuous monitoring, Slack/email alerts, multi-project and white-label reports.
Drag & drop your dependency file
composer.lock, package-lock.json, requirements.txt, Gemfile.lock, pubspec.lock, Dockerfile...