CVE-2026-16289: CWE-862 Missing Authorization in ProfileGrid
ProfileGrid WordPress plugin versions before 6.0.0.0 contain a missing authorization vulnerability that allows any authenticated user, including Subscribers, to view pending membership requests for any group, even private ones. This exposure reveals the names and request dates of users awaiting group approval. The vulnerability does not allow modification or denial of service but discloses sensitive membership information.
AI Analysis
Technical Summary
CVE-2026-16289 is a missing authorization vulnerability (CWE-862) in the ProfileGrid WordPress plugin prior to version 6.0.0.0. The plugin fails to perform proper authorization checks when listing a group's pending membership requests. As a result, any authenticated user can access the names and request dates of users awaiting approval to join any group, including private groups. This information disclosure could lead to privacy concerns but does not allow further privilege escalation or data modification.
Potential Impact
The vulnerability allows disclosure of pending membership request details (names and request dates) to any authenticated user, including low-privilege roles such as Subscribers. There is no impact on data integrity or availability. The confidentiality impact is limited to exposure of membership request information.
Mitigation Recommendations
No official fix or patch is currently documented. Users should upgrade to ProfileGrid version 6.0.0.0 or later once available, as the vulnerability affects all versions prior to 6.0.0.0. Until a patch is released, restrict authenticated user roles or limit group membership request visibility as a temporary measure. Monitor the vendor advisory for updates on remediation.
CVE-2026-16289: CWE-862 Missing Authorization in ProfileGrid
Description
ProfileGrid WordPress plugin versions before 6.0.0.0 contain a missing authorization vulnerability that allows any authenticated user, including Subscribers, to view pending membership requests for any group, even private ones. This exposure reveals the names and request dates of users awaiting group approval. The vulnerability does not allow modification or denial of service but discloses sensitive membership information.
CVSS v3.1
Score 4.3medium
Affected software
ProfileGrid
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-16289 is a missing authorization vulnerability (CWE-862) in the ProfileGrid WordPress plugin prior to version 6.0.0.0. The plugin fails to perform proper authorization checks when listing a group's pending membership requests. As a result, any authenticated user can access the names and request dates of users awaiting approval to join any group, including private groups. This information disclosure could lead to privacy concerns but does not allow further privilege escalation or data modification.
Potential Impact
The vulnerability allows disclosure of pending membership request details (names and request dates) to any authenticated user, including low-privilege roles such as Subscribers. There is no impact on data integrity or availability. The confidentiality impact is limited to exposure of membership request information.
Mitigation Recommendations
No official fix or patch is currently documented. Users should upgrade to ProfileGrid version 6.0.0.0 or later once available, as the vulnerability affects all versions prior to 6.0.0.0. Until a patch is released, restrict authenticated user roles or limit group membership request visibility as a temporary measure. Monitor the vendor advisory for updates on remediation.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- WPScan
- Date Reserved
- 2026-07-20T12:19:37.183Z
- State
- PUBLISHED
Threat ID: 6a70364ebf32cb7a34183127
Added to database: 08/03/2026, 06:33:50 UTC
Last enriched: 08/10/2026, 15:11:40 UTC
Last updated: 09/17/2026, 22:01:33 UTC
Views: 49
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.