CVE-2026-12690
LowCVSS 3.8Exploitation Probability (EPSS)
Low risk5th percentile - higher than 5% of all known CVEs
Summary
The ProfileGrid WordPress plugin before version 5.9.9.7 does not perform a capability check on its license management actions, relying only on a nonce that is exposed to any logged-in user, allowing authenticated users with Subscriber-level access and above to overwrite the site's premium license settings.
Risk Assessment
Low-privileged users can alter premium license settings, potentially leading to unauthorized access to premium features or disruption of the plugin.
Recommendation
Update the ProfileGrid plugin to version 5.9.9.7 or later.
Original NVD description (English source)
The ProfileGrid WordPress plugin before 5.9.9.7 does not perform a capability check on its license management actions, relying only on a nonce that is exposed to any logged-in user, allowing authenticated users with Subscriber-level access and above to overwrite the site's premium license settings.