CVE-2026-4607: Authorization Bypass in ProfileGrid WordPress Plugin

The primary impact of this vulnerability lies in the ability of an attacker to modify ProfileGrid group settings without proper authorization. This includes altering the group menu order, list order, icon display, and field ordering. While not a direct data breach, unauthorized modification of these settings can disrupt site functionality, create confusion for administrators, and potentially lead to misconfiguration impacting user experience. An attacker could systematically alter group settings to hinder legitimate users or create a misleading site structure. The blast radius is limited to the ProfileGrid plugin's functionality within the WordPress site, but the impact on site administration and user experience can be significant.

1. Reserved2026-03-23
2. 公開日2026-05-13

The primary mitigation is to upgrade the ProfileGrid plugin to version 5.9.8.5 or later. If an immediate upgrade is not feasible due to compatibility concerns or testing requirements, consider implementing a temporary workaround by restricting access to the pmsetgrouporder, pmsetgroupitems, and pmsetfield_order AJAX actions to administrators only. This can be achieved through custom code or a WordPress security plugin. Monitor WordPress logs for suspicious activity related to these AJAX actions. After upgrading, confirm the fix by logging in as a Subscriber and attempting to modify group settings – the action should be denied.