WordPress Plugin Vulnerabilities

ProfileGrid – User Profiles, Groups and Communities < 6.0.0.3 - Unauthenticated Insecure Direct Object Reference

Description

The ProfileGrid – User Profiles, Groups and Communities plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 6.0.0.2. This is due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to perform an unauthorized action.

Affects Plugins

Plugin icon
profilegrid-user-profiles-groups-and-communities
Fixed in 6.0.0.3

References

CVE
CVE-2026-62061
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/6d984c59-77ff-4283-ac79-910885e46443

Classification

Type
IDOR
OWASP top 10
A5: Broken Access Control
CWE
CWE-639
CVSS
5.3 (medium)

Miscellaneous

Original Researcher
Zenith
Verified
No
WPVDB ID
10c18025-11e3-4d58-b160-f3c5d8db9ab6

Timeline

Publicly Published
2026-10-01 (about 15 days ago)
Added
2026-10-09 (about 8 days ago)
Last Updated
2026-10-09 (about 8 days ago)

Other

Published
Title
Published
2026-09-17
Title
LatePoint - Appointment Booking & Scheduling < 5.6.10 - Unauthenticated Insecure Direct Object Reference to Sensitive Information Disclosure via 'customer[id]' Parameter
Published
2026-08-31
Title
MasterStudy LMS < 3.7.46 - Instructor+ Quiz Answer Disclosure via IDOR
Published
2026-09-06
Title
Otter Blocks < 3.1.8 - Missing Authorization to Unauthenticated Purchase Verification Bypass
Published
2026-10-05
Title
JS Help Desk – AI-Powered Support & Ticketing System < 5.0.0 - Authenticated (Subscriber+) Insecure Direct Object Reference
Published
2024-06-28
Title
Page and Post Clone < 6.1 - Insecure Direct Object Reference to Authenticated (Author+) Sensitive Information Exposure