CVE-2026-4607 is an authorization bypass vulnerability (CWE-862) in the ProfileGrid – User Profiles, Groups and Communities WordPress plugin. The plugin fails to verify user authorization for the AJAX actions pm_set_group_order, pm_set_group_items, and pm_set_field_order. As a result, authenticated users with Subscriber-level privileges or higher can alter site-wide ProfileGrid group settings, including menu order, list order, icon display, and field ordering. This vulnerability affects all versions up to and including 5.9.8.4. The CVSS v3.1 base score is 4.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N), reflecting a network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, no confidentiality or availability impact, and limited integrity impact. No patch or official remediation has been published by the vendor as of the latest information.

An authenticated attacker with Subscriber-level access or higher can bypass authorization controls to modify site-wide group settings in the ProfileGrid plugin. This includes changing group menu order, group list order, group icon display, and field ordering. The impact is limited to integrity of group configuration data; there is no direct confidentiality or availability impact reported. No known exploits are currently active in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict Subscriber-level access where possible and monitor for unusual changes to ProfileGrid group settings. Avoid granting unnecessary privileges to authenticated users. No vendor-provided temporary fixes or workarounds have been documented.