CVE-2026-4608 is a blind SQL Injection vulnerability in the ProfileGrid – User Profiles, Groups and Communities WordPress plugin. The issue arises from improper neutralization of special elements in the 'rid' parameter, allowing authenticated attackers with Subscriber-level privileges or higher to append SQL queries to existing database commands. This occurs because the plugin fails to sufficiently escape user input and does not use prepared statements, enabling extraction of sensitive information from the database. The vulnerability affects all versions up to and including 5.9.8.4. The CVSS 3.1 base score is 6.5 (medium severity), with an attack vector of network, low attack complexity, and requiring privileges. No official fix or patch has been published by the vendor as of the data provided.

An attacker with at least Subscriber-level access can exploit this vulnerability to perform blind SQL Injection attacks, potentially extracting sensitive information from the database. The vulnerability does not impact integrity or availability directly but compromises confidentiality. No known exploits are reported in the wild, reducing immediate risk, but the potential for data leakage exists if exploited.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict Subscriber-level access where possible and monitor for suspicious activity related to the 'rid' parameter. Avoid exposing this plugin on sensitive environments or consider disabling it temporarily if feasible.