WordPress Plugin Vulnerabilities

ProfileGrid < 5.9.9.8 - Subscriber+ Arbitrary Notification Deletion via IDOR

Description

The plugin does not verify that a notification belongs to the requesting user before deleting it, allowing any authenticated user such as a Subscriber to delete other users' notifications by enumerating notification identifiers.

Proof of Concept

Affects Plugins

Plugin icon
profilegrid-user-profiles-groups-and-communities
Fixed in 5.9.9.8

References

CVE
CVE-2026-16291

Classification

Type
IDOR
OWASP top 10
A5: Broken Access Control
CWE
CWE-639
CVSS
4.3 (medium)

Miscellaneous

Original Researcher
Meher Sudhakar Abbireddi
Submitter
Meher Sudhakar Abbireddi
Verified
Yes
WPVDB ID
899c2e96-39a9-4e1c-879b-40d6e629e712

Timeline

Publicly Published
2026-07-21 (about 12 days ago)
Added
2026-07-21 (about 11 days ago)
Last Updated
2026-07-21 (about 11 days ago)

Other

Published
Title
Published
2025-12-31
Title
Master Addons for Elementor < 2.1.0 - Unauthenticated Insecure Direct Object Reference
Published
2025-01-31
Title
WP Job Portal < 2.2.7 - Insecure Direct Object Reference to Authenticated (Employer+) Arbitrary Company Deletion
Published
2024-10-25
Title
School Management System – WPSchoolPress < 2.2.11 - Insecure Direct Object Reference to Authenticated (Teacher+) Account Takeover/Privilege Escalation
Published
2025-01-14
Title
Piotnet Addons For Elementor < 2.4.33 - Authenticated (Contributor+) Post Disclosure
Published
2026-07-01
Title
Academy LMS < 3.8.2 - Unauthenticated Insecure Direct Object Reference to Private Topic Disclosure