CVE-2026-12073

This flaw lets an attacker change the email address on the site’s main user account (usually the administrator), without needing a login. Once the email is changed, the attacker can use the normal “forgot password” flow to take over the account.

This matters if you run a WordPress site that uses the plugin “ProfileGrid – User Profiles, Groups and Communities” at version 5.9.9.5 or earlier. Because the attacker does not need to log in first, the risk is highest if your site exposes the plugin’s registration functionality to the public internet. The practical gate is whether the plugin/version is in use and the attacker can reach the relevant registration form behavior (including submitting requests that omit user_login).

This is urgent because the weakness is directly exploitable by an unauthenticated attacker to take over the administrator account. While there is no CISA KEV entry and no public exploit code on record, the impact is account takeover (not just a nuisance), so you should treat it as a priority fix now.

1. Confirm exposure

   • In WordPress admin, open Plugins and find “ProfileGrid – User Profiles, Groups and Communities”. Record the installed version.
   • If the version is 5.9.9.5 or lower, you should assume you are exposed.

2. Confirm whether user ID=1 is in play

   • In many WordPress setups, user ID=1 is the original administrator. Verify whether the email address for the main administrator account appears recently changed.

3. Immediate mitigation (if you can’t patch right away)

   • Disable the ProfileGrid plugin immediately.
   • If your site requires that functionality, consider removing it temporarily and using an alternative until you can update to a fixed version.

4. Upgrade path

   • The findings report no patch/upgrade version information available. Work with your plugin vendor/source to obtain a version that explicitly addresses CVE-2026-12073.
   • If no fixed version is available, the safest operational path is to remove the plugin and replace it.

5. Post-change checks

   • Review your WordPress admin users for any suspicious changes:
     • Administrator email changes
     • Any new administrator accounts
     • Recent password reset activity
   • Ensure passwords for all administrator accounts are rotated after you disable/remove or update the plugin.

6. What to monitor

   • Monitor logs (or hosting security events) for unusual registration-related requests and password reset attempts.
   • Watch for repeated failed/edge-case registration form submissions consistent with “email overwrite” behavior.

7. CISA due date

   • No KEV entry was listed for this CVE, so no KEV-driven due date is provided in the findings.

Severity is critical in practice because it enables account takeover of the administrator: an unauthenticated attacker can change the email associated with user ID=1. The underlying weakness is an authorization bypass (CWE-639) caused by missing/insufficient validation of user_login on registration forms that don’t include that parameter, combined with improper error-message handling. Reported prerequisites include: ProfileGrid plugin version 5.9.9.5 or lower; existence of user ID=1 (often the admin); and the attacker being able to submit registration-form requests without user_login and reach the flawed processing path. Exploitation status: no KEV entry and no public exploit code is on record (so the findings do not confirm widespread public tooling), but the described impact is full privilege escalation. EPSS/other predictive metrics are not included in the provided findings, so they are not referenced here.