CVE-2026-2488 is a missing authorization vulnerability (CWE-862) in the ProfileGrid – User Profiles, Groups and Communities WordPress plugin. The vulnerability arises from the pg_delete_msg() function failing to verify user permissions before allowing message deletion. Authenticated users with Subscriber-level privileges or higher can exploit this flaw by sending a direct request with a valid message ID to delete arbitrary messages of other users. This issue affects all plugin versions up to 5.9.8.1. The vulnerability has a CVSS 3.1 base score of 4.3, reflecting a network attack vector, low attack complexity, and requiring low privileges with no user interaction. The impact is limited to integrity loss (unauthorized message deletion) without confidentiality or availability impact. No known exploits in the wild or vendor patches have been reported as of the publication date.

An attacker with at least Subscriber-level access can delete messages belonging to other users without authorization, resulting in unauthorized modification of data (integrity impact). There is no direct impact on confidentiality or availability. This could disrupt user communications or cause loss of message data within the affected plugin environment.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, administrators should consider restricting Subscriber-level access or disabling the ProfileGrid messaging feature if feasible. Monitoring for suspicious message deletions may help detect exploitation attempts. Avoid granting unnecessary privileges to users to reduce risk.