CVE-2026-4609 is a missing authorization vulnerability (CWE-862) in the ProfileGrid plugin for WordPress, specifically in the pm_invite_user function. The plugin fails to perform proper capability checks, allowing authenticated users with minimal privileges (Subscriber-level and above) to add themselves or others to any ProfileGrid group, including those that are closed or require payment. This bypasses intended access controls and payment gates, potentially leading to unauthorized group membership and associated privilege escalation within the plugin's context. The vulnerability affects all versions up to and including 5.9.8.4. No official patch or remediation guidance is currently available from the vendor.

Exploitation allows authenticated users with Subscriber-level access or higher to bypass authorization and payment restrictions to join any ProfileGrid group, including closed and paid groups. This could lead to unauthorized access to restricted group content or services. The vulnerability does not impact confidentiality beyond the plugin's group membership controls, but it does allow integrity violations by unauthorized group additions. Availability is not affected. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, administrators should consider restricting Subscriber-level access or disabling the ProfileGrid plugin if unauthorized group membership poses a significant risk. Monitoring for unusual group membership changes may help detect exploitation attempts.