Deze pagina is nog niet vertaald naar uw taal. We werken eraan — de inhoud wordt voorlopig in het Engels weergegeven.
💡 Keep dependencies up to date — most exploits target known, patchable vulnerabilities.
CVE-2026-4609: Unauthorized Access in ProfileGrid
Platform
wordpress
Component
profilegrid-user-profiles-groups-and-communities
Opgelost in
5.9.8.5
CVE-2026-4609 affects ProfileGrid, a WordPress plugin for user profiles, groups, and communities. This vulnerability allows authenticated attackers with Subscriber-level access or higher to bypass authorization checks and add users to any group, regardless of its access restrictions or payment status. The vulnerability impacts versions 0.0.0 through 5.9.8.4, and a fix is available in version 5.9.8.5.
Detecteer deze CVE in je project
Upload je dependency-bestand en kom direct te weten of deze en andere CVEs jou raken.
Impact en Aanvalsscenarioswordt vertaald…
The primary impact of CVE-2026-4609 is the potential for unauthorized access to closed and paid groups within ProfileGrid. An attacker, already logged in with a Subscriber account or higher, can leverage this vulnerability to add themselves or other registered users to these groups. This bypasses all authorization and payment mechanisms, granting access to content and features that should be restricted. This could lead to data breaches, exposure of sensitive information, and disruption of paid services. The ability to add arbitrary users to groups also opens the door for further malicious activity within those groups, such as spamming or phishing campaigns.
Uitbuitingscontextwordt vertaald…
CVE-2026-4609 was published on May 13, 2026. Its severity is rated HIGH (CVSS 7.1). Currently, there are no publicly available exploits or active campaigns targeting this vulnerability. It is not listed on KEV or EPSS, indicating a low to medium probability of exploitation. Monitor security advisories and threat intelligence feeds for any updates.
Dreigingsinformatie
Exploit Status
CVSS-vector
Wat betekenen deze metrics?
- Attack Vector
- Netwerk — op afstand uitbuitbaar via internet. Geen fysieke of lokale toegang vereist.
- Attack Complexity
- Laag — geen speciale voorwaarden vereist. Betrouwbaar uitbuitbaar.
- Privileges Required
- Laag — elk geldig gebruikersaccount is voldoende.
- User Interaction
- Geen — automatische en stille aanval. Slachtoffer doet niets.
- Scope
- Ongewijzigd — impact beperkt tot het kwetsbare component.
- Confidentiality
- Laag — gedeeltelijke toegang tot enkele gegevens.
- Integrity
- Hoog — aanvaller kan alle gegevens schrijven, aanpassen of verwijderen.
- Availability
- Geen — geen beschikbaarheidsimpact.
Getroffen Software
Zwakheidsclassificatie (CWE)
Tijdlijn
- Reserved
- Gepubliceerd
Mitigatie en Workaroundswordt vertaald…
The recommended mitigation for CVE-2026-4609 is to immediately upgrade ProfileGrid to version 5.9.8.5 or later. If upgrading is not immediately feasible due to compatibility issues or breaking changes, consider implementing a temporary workaround by restricting group membership management to administrators only. Review user roles and permissions within ProfileGrid to ensure that only authorized personnel have the ability to manage group memberships. While a direct WAF rule is difficult to implement, monitor ProfileGrid logs for suspicious activity related to group membership changes and user additions.
Hoe te verhelpenwordt vertaald…
Update to version 5.9.8.5, or a newer patched version
Veelgestelde vragenwordt vertaald…
What is CVE-2026-4609 — Unauthorized Access in ProfileGrid?
CVE-2026-4609 is a HIGH severity vulnerability in ProfileGrid WordPress plugin allowing authenticated users to bypass authorization and add users to any group, including paid ones, impacting versions 0.0.0–5.9.8.4.
Am I affected by CVE-2026-4609 in ProfileGrid?
If you are using ProfileGrid version 0.0.0 through 5.9.8.4 on your WordPress site, you are potentially affected by this vulnerability. Check your plugin version immediately.
How do I fix CVE-2026-4609 in ProfileGrid?
Upgrade ProfileGrid to version 5.9.8.5 or later to resolve the vulnerability. If immediate upgrade is not possible, restrict group membership management to administrators as a temporary workaround.
Is CVE-2026-4609 being actively exploited?
As of the current assessment, CVE-2026-4609 is not known to be actively exploited, but it remains a significant risk due to the ease of exploitation.
Where can I find the official ProfileGrid advisory for CVE-2026-4609?
Refer to the ProfileGrid website and WordPress plugin repository for the official advisory and update information regarding CVE-2026-4609.
Is jouw project getroffen?
Upload je dependency-bestand en kom direct te weten of deze en andere CVEs jou raken.
Detecteer deze CVE in je project
Upload je dependency-bestand en kom direct te weten of deze en andere CVEs jou raken.
Scan nu uw WordPress project — geen account
Upload een manifest (composer.lock, package-lock.json, WordPress pluginlijst…) of plak uw componentenlijst. U ontvangt direct een kwetsbaarheidsrapport. Een bestand uploaden is slechts het begin: met een account krijgt u continue monitoring, Slack/e-mail alerts, multi-project en white-label rapporten.
Sleep uw afhankelijkheidsbestand hierheen
composer.lock, package-lock.json, requirements.txt, Gemfile.lock, pubspec.lock, Dockerfile...