CVE-2026-12073 is a critical authorization bypass vulnerability in the ProfileGrid plugin for WordPress, affecting all versions up to and including 5.9.9.5. The vulnerability arises because the plugin does not validate the user_login parameter on registration forms that omit it and improperly handles error messages. This allows unauthenticated attackers to modify the email address of the user with ID=1, usually the administrator, enabling them to reset the password and take over the account. The CVSS 3.1 score is 9.8, reflecting the high impact and ease of exploitation without authentication.

Successful exploitation results in complete compromise of the administrator account by allowing an attacker to change the administrator's email address and reset the password. This leads to full control over the WordPress site, including confidentiality, integrity, and availability impacts.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to registration forms and monitor for suspicious activity related to user account changes. Avoid using vulnerable versions (<=5.9.9.5) in production environments.