ProfileGrid < 5.9.9.6 - Unauthenticated Privilege Escalation via Email Overwrite

Description

The plugin is vulnerable to privilege escalation via account takeover due to the plugin not validating a `user_login` on registration forms that don't contain this parameter, and not properly handling the error messages. This makes it possible for unauthenticated attackers to change email address of user account with ID=1 (usually an administrator), and leverage that to reset the user's password and gain access to their account.