CVE Tools
Sign in

CVE-2026-12073

ProfileGrid - User Profiles, Groups and Communities <= 5.9.9.5 - Unauthenticated Privilege Escalation via Email Overwrite

Published: Jun 30, 2026Updated: Jun 30, 2026 Sources: CVE List NVDCWE-639
9.8CRITICAL
NVD MITRE
EPSS Score
0.5%
Top 57.6%
CISA KEV
Not in KEV
Exploits
No Known Exploits
Remediation
No Fix Available
Self-Check
Not available

Description

The ProfileGrid – User Profiles, Groups and Communities plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 5.9.9.5. This is due to the plugin not validating a `user_login` on registration forms that don't contain this parameter, and not properly handling the error messages. This makes it possible for unauthenticated attackers to change email address of user account with ID=1 (usually an administrator), and leverage that to reset the user's password and gain access to their account.

In plain language

AI Worth attention

ProfileGrid (a WordPress plugin) versions up to 5.9.9.5 have a serious security flaw where an unauthenticated attacker can change the admin’s email and take over the account—small businesses using this plugin should act now, since it can enable full account takeover.

Executive summary

In ProfileGrid – User Profiles, Groups and Communities (≤ 5.9.9.5), unauthenticated attackers can trigger an authorization bypass (CWE-639) by submitting registration-form requests that omit `user_login` and mishandle errors, letting them overwrite the email for user ID=1 (typically the administrator) and then reset the password to gain full access.

If affected, business impact
Full administrator account takeoverPassword reset leading to accessPrivilege escalation within WordPressService disruption from lockouts

What to do now

  1. Check your WordPress site for the installed plugin “ProfileGrid – User Profiles, Groups and Communities” and note its exact version.
  2. If the version is 5.9.9.5 or lower, stop using the vulnerable plugin immediately (disable it) until you can update or mitigate.
  3. Look for an update from your plugin source/vendor that fixes CVE-2026-12073; if no fixed version is available, remove the plugin and replace it with a safe alternative.
  4. Audit your WordPress user accounts for unexpected changes to the administrator email address and any suspicious recent password resets.
  5. After changes, monitor login activity and password reset events for unusual patterns (especially around registration-related actions).
May need vendor / contractor work

CVSS Vector Breakdown

AV:NAC:LPR:NUI:NS:UC:HI:HA:H
Exploitability
AV:NAttack Vector
Network
AC:LAttack Complexity
Low
PR:NPrivileges Required
None
UI:NUser Interaction
None
Scope
S:UScope
Unchanged
Impact
C:HConfidentiality
High
I:HIntegrity
High
A:HAvailability
High
Open in CVSS calculator →

Weaknesses

CWE-639

Affected Products

metagauss
commercial
ProfileGrid – User Profiles, Groups and CommunitiesOn-premWeb App
Enterprise Software / collaboration-groupware

Exploitability

No known exploits, KEV entries, or remediation guidance available for this vulnerability yet.
Is your org exposed to CVE-2026-12073?We can run the check for you — a free external exposure review, no install. Check my exposure

Attack Graph

Products CVE Techniques Tactics

Click technique nodes for MITRE ATT&CK details · drag to pan · Ctrl/⌘ + scroll to zoom, or go fullscreen.

MITRE ATT&CK

1 technique
Initial Access
View detailed technique mapping

References

https://www.wordfence.com/threat-intel/vulnerabilities/id/2d35279d-299e-4ca2-8f84-165284e058c8?source=cve
wordfence.com
https://plugins.trac.wordpress.org/changeset/3578435/
plugins.trac.wordpress.org

Unlock Complete Vulnerability Intelligence

Get the full picture for CVE-2026-12073 and every CVE in our database. Create a free account — no credit card required.

Create Free Account
Plain-language analysis
Impact assessment and exploitation scenario in plain English
Attack graph visualization
Interactive attack path and kill chain mapping
Exploit details & PoC links
ExploitDB, Metasploit, GitHub PoCs with direct links
Nuclei scanner templates
Ready-to-use vulnerability scanner templates
Full remediation guide
Patch instructions, workarounds, and compliance impact
Interactive AI chat
Ask questions about this vulnerability in natural language
Related vulnerabilities
Semantically similar CVEs and attack patterns
REST API & MCP access
Integrate vulnerability data into your workflows