ProfileGrid <= 5.9.8.2 - 跨站请求伪造可用于群组会员请求批准/拒绝

The core impact of CVE-2026-2494 lies in the ability of an attacker to leverage CSRF to control group membership within a WordPress site using the ProfileGrid plugin. An attacker could craft a malicious link or embed a hidden form on a website that, when visited by an administrator, would automatically approve or deny group membership requests without their knowledge or consent. This could lead to unauthorized users gaining access to restricted groups or legitimate users being unfairly denied access. The blast radius is limited to sites utilizing the ProfileGrid plugin, but the potential for disruption and unauthorized access warrants immediate attention.

WordPress sites utilizing the ProfileGrid plugin, particularly those with multiple administrators or shared administrator accounts, are at increased risk. Sites with publicly accessible membership request management pages are also more vulnerable. Shared hosting environments where multiple websites share the same server resources should be carefully monitored.

• wordpress / composer / npm:

grep -r 'approve|decline' /var/www/html/wp-content/plugins/profilegrid/

• wordpress / composer / npm:

wp plugin list --status=all | grep profilegrid

• wordpress / composer / npm:

wp plugin update profilegrid

• generic web: Check for suspicious links in administrator email inboxes that redirect to ProfileGrid membership management pages.

1. 2026-03-07Disclosure

   disclosure

1. 已保留2026-02-13
2. 发布日期2026-03-07
3. 修改日期2026-04-08
4. EPSS 更新日期2026-03-23

The primary mitigation for CVE-2026-2494 is to immediately upgrade the ProfileGrid plugin to version 5.9.8.3 or later. If upgrading is not immediately feasible due to compatibility issues or testing requirements, consider implementing temporary workarounds. While a direct WAF rule targeting this specific CSRF vulnerability might be difficult to create, general CSRF protection rules can help mitigate the risk. Carefully review and restrict access to the membership request management page, limiting access to authorized administrators only. Regularly audit user roles and group memberships to detect any unauthorized changes.

活跃安装数

6K热门

插件评分