CVE-2026-12073: ProfileGrid - User Profiles, Groups and Communities <= 5.9.9.5 - Unauthenticated Privilege Escalation via Email Overwrite

Synopsis

This is a privilege escalation via account takeover vulnerability in the ProfileGrid plugin for WordPress (versions up to and including 5.9.9.5). An unauthenticated attacker reachable over the network can exploit missing validation on registration forms to overwrite the email address of the WordPress administrator account (user ID 1), then trigger a standard password reset to gain full admin access. Successful exploitation gives the attacker complete control over the WordPress site with no credentials required. HarborGuard is tracking this advisory and will make a patched-image rebuild available the moment an upstream fix is published.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the WordPress registration endpoint over the network; no local or physical access is needed.

• AuthenticationNot required

  No account or credentials of any kind are needed; the attack is available to any unauthenticated HTTP client.

• Victim interactionNot required

  The attacker manipulates the registration form directly; no action by any logged-in user is required to complete the takeover.

• Attack complexityDetail

  Exploitation is reliable and condition-free: the attacker only needs to send crafted registration requests, with no race conditions or special environmental factors required.

Blast Radius

• Attacker overwrites the email address of the site's primary administrator account (user ID 1) and resets its password, gaining full admin-level access to the WordPress dashboard.
• With admin access, the attacker can read all stored user data, private content, and any credentials or API keys stored in the site's settings.
• The attacker can install or modify plugins and themes, injecting persistent backdoors or malicious code into the site.
• The attacker can delete content, modify database records, or take the site fully offline, causing complete service disruption.