CVE-2026-12073 is a critical authorization bypass vulnerability in the ProfileGrid WordPress plugin caused by improper validation of the user_login parameter during registration. The plugin fails to validate this parameter when it is missing and mishandles error messages, allowing unauthenticated attackers to modify the email address of the administrative user (ID=1). This enables attackers to reset the administrator's password and take over the account, resulting in full compromise of the affected WordPress site. The vulnerability affects all versions up to and including 5.9.9.5. No official patch or remediation guidance is currently available from the vendor.

Successful exploitation allows unauthenticated attackers to escalate privileges by taking over the administrator account, leading to complete compromise of the WordPress site. Confidentiality, integrity, and availability of the site are fully impacted as attackers can reset passwords and gain administrative control.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to registration forms, monitor for suspicious activity, and consider disabling the plugin if possible to prevent exploitation.