CVE-2026-12687 is a privilege escalation vulnerability in the ProfileGrid WordPress plugin prior to version 5.9.9.8. The plugin does not properly restrict which group an anonymous visitor can register into through its front-end registration feature. As a result, unauthenticated users can register directly into privileged groups and inherit the associated roles, including Administrator if such a group exists. This issue is classified under CWE-269 (Improper Privilege Management). No official patch or remediation guidance is currently provided by the vendor or advisory sources.

An attacker can gain elevated privileges by registering as a member of a privileged group without authentication. This can lead to unauthorized administrative access to the WordPress site, compromising confidentiality and potentially allowing further malicious actions. The CVSS score of 7.5 reflects a high severity with network attack vector, low attack complexity, no privileges required, and no user interaction needed. The impact is limited to confidentiality as per the CVSS vector; integrity and availability impacts are not indicated.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict or disable front-end registration or manually monitor and control group memberships to prevent unauthorized privilege escalation.