CVE-2026-16290 describes a missing authorization check in the ProfileGrid WordPress plugin prior to version 6.0.0.0. The plugin registers a handler accessible to unauthenticated users that returns group member lists without verifying permissions. This flaw allows any unauthenticated visitor to retrieve members and their identifiers from any group, including those marked private or closed, effectively bypassing the plugin's member-visibility controls.

The vulnerability results in unauthorized disclosure of group member information, including identifiers, to unauthenticated users. There is no impact on integrity or availability reported. The confidentiality impact is limited to exposure of member lists that should be restricted according to group settings.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Users should monitor the ProfileGrid plugin's official channels for updates and apply any released patches promptly. Until a fix is available, consider restricting access to the plugin or disabling it if feasible to prevent unauthorized data disclosure.