CVE-2025-13416 is a missing authorization vulnerability in the ProfileGrid WordPress plugin affecting all versions up to 5.9.7.2. The pm_deactivate_user_from_group() function lacks a capability check, enabling authenticated users with minimal privileges (Subscriber and above) to suspend arbitrary users from groups via the pm_deactivate_user_from_group AJAX action. This can impact group membership management by unauthorized suspension of users, including administrators. The vulnerability does not affect confidentiality or availability but impacts integrity by allowing unauthorized modification of group membership status.

An attacker with Subscriber-level access or higher can suspend arbitrary users from groups, including administrators, without authorization. This could disrupt group management and user roles within the affected WordPress site. There is no indication of impact on data confidentiality or system availability. No known exploits are reported in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict Subscriber-level user capabilities where possible and monitor for suspicious activity related to group membership changes. Avoid granting unnecessary privileges to low-level authenticated users. Follow vendor updates closely for an official patch or temporary mitigation.