WordPress Plugin Vulnerabilities

ProfileGrid < 6.0.0.0 - Subscriber+ Group Join Request Disclosure via pm_get_all_requests_from_group

Description

The plugin does not perform authorization checks when listing a group's pending membership requests, allowing any authenticated user such as a Subscriber to disclose the names and request dates of the users awaiting approval to join any group, including private ones.

Proof of Concept

Affects Plugins

Plugin icon
profilegrid-user-profiles-groups-and-communities
Fixed in 6.0.0.0

References

CVE
CVE-2026-16289

Classification

Type
NO AUTHORISATION
OWASP top 10
A5: Broken Access Control
CWE
CWE-862
CVSS
4.3 (medium)

Miscellaneous

Original Researcher
Meher Sudhakar Abbireddi
Submitter
Meher Sudhakar Abbireddi
Verified
Yes
WPVDB ID
815a2245-6477-42a1-b08a-fa308a830be3

Timeline

Publicly Published
2026-07-24 (about 11 days ago)
Added
2026-07-24 (about 10 days ago)
Last Updated
2026-07-24 (about 10 days ago)

Other

Published
Title
Published
2025-09-22
Title
Classic Widgets with Block-based Widgets <= 1.0.1 - Missing Authorization
Published
2024-07-19
Title
Security Optimizer – The All-In-One Protection Plugin < 1.5.1 - Missing Authorization via hide_notice()
Published
2026-02-20
Title
Filter & Grids < 3.5.2 - Missing Authorization
Published
2026-07-02
Title
weDocs: AI Powered Knowledge Base, Docs, Documentation, Wiki & AI Chatbot < 2.3.1 - Missing Authorization to Authenticated (Subscriber+) Data Migration via wedocs_migrate_betterdocs_to_wedocs AJAX Action
Published
2026-01-10
Title
Creator LMS < 1.1.13 - Missing Authorization