CVE-2026-12689 is a CWE-862 Missing Authorization vulnerability in the ProfileGrid WordPress plugin prior to version 5.9.9.7. The plugin fails to perform authorization or ownership verification on certain private-message thread actions. As a result, authenticated users with Subscriber-level privileges or above can perform unauthorized actions such as soft-deleting, tampering with metadata, and marking other users' private message threads as read. The vulnerability has a CVSS 3.1 base score of 5.4, reflecting low complexity and network attack vector, with limited confidentiality and integrity impact and no availability impact. No official patch or remediation guidance is currently provided, and no known exploits are reported in the wild.

The vulnerability allows unauthorized authenticated users to manipulate private message threads of other users by soft-deleting them, altering metadata, and marking them as read. This leads to limited confidentiality and integrity impacts on user private messages. There is no impact on system availability. The attack requires authenticated access at Subscriber level or higher.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict Subscriber-level access where possible and monitor for suspicious activity related to private message threads. Avoid granting unnecessary privileges to users. Follow vendor updates for a forthcoming patch.