CVE-2026-12688 is an improper access control vulnerability (CWE-284) in the ProfileGrid WordPress plugin prior to version 5.9.9.7. The flaw arises because the plugin does not properly verify PayPal Instant Payment Notification (IPN) messages before granting paid group membership. As a result, attackers can forge IPN notifications to fraudulently mark any user as a paid member of any group without making a payment. This vulnerability has a CVSS 3.1 base score of 6.5, indicating a medium severity level. No official patch or remediation guidance is currently provided by the vendor, and no known exploits are reported in the wild.

An attacker can bypass payment verification and fraudulently assign paid group membership to any user. This could lead to unauthorized access to paid content or services within the ProfileGrid plugin. The confidentiality and integrity of membership status are impacted, but availability is not affected.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, administrators should monitor for suspicious membership changes and consider disabling paid membership features or restricting PayPal IPN processing until the vulnerability is addressed.