CVE-2026-12688 describes an improper access control vulnerability (CWE-284) in the ProfileGrid WordPress plugin prior to version 5.9.9.7. The vulnerability arises because the plugin does not properly verify PayPal Instant Payment Notification (IPN) messages before granting paid group membership. An attacker can exploit this by forging a PayPal IPN notification, thereby marking any user as a paid member of any group without completing a legitimate payment transaction.

Successful exploitation allows unauthenticated attackers to bypass payment verification and fraudulently assign paid group memberships to users. This could lead to unauthorized access to paid content or services managed by the ProfileGrid plugin, potentially causing financial loss or service abuse for the site owner.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, site administrators should monitor for updates from the ProfileGrid plugin vendor and apply patches promptly once released. Consider disabling or restricting paid group membership features if feasible until the vulnerability is addressed.