CRITICALVulnerability
Verified
Global

NVD CRITICAL: CVE-2026-12073 — The ProfileGrid – User Profiles, Groups and Communities plugin for WordPress is ...

·Source: NIST NVD

Updated:

Executive Summary

The ProfileGrid – User Profiles, Groups and Communities plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 5.9.9.5. This is due to the plugin not validating a `user_login` on registration forms that don't contain this parameter, and not properly handling the error messages. This makes it possible for unauthenticated attackers to ch

Analysis

The ProfileGrid – User Profiles, Groups and Communities plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 5.9.9.5. This is due to the plugin not validating a `user_login` on registration forms that don't contain this parameter, and not properly handling the error messages. This makes it possible for unauthenticated attackers to change email address of user account with ID=1 (usually an administrator), and leverage that to reset the user's password and gain access to their account. CVSS Score: 9.8. Published: 2026-06-30T06:16:26.560.

Indicators of Compromise (2)

CVE (1)
CVE-2026-12073
NVDMITRE CVE
Source Attribution

Originally published by NIST NVD on Jun 30, 2026. Verified by: NIST.

Related Threats

MEDIUMVulnerabilityNEW

Anchorage Digital integrates with Lido to expand institutional access to Ethereum liquid staking

Anchorage Digital, home to America's first federally regulated crypto bank, has integrated with Lido, the largest liquid staking protocol on Ethereum, giving institutions compliant access to wstETH without leaving the Anchorage Digital platform.

Finextra
MEDIUMVulnerabilityNEW

Paysera becomes direct Visa member

Paysera LT, UAB has obtained the status of a direct Visa member (Issuing Principal Member) – one of the highest statuses in the payments industry.

Finextra
MEDIUMVulnerabilityNEW

Ondo Finance launches custodial tokenised securities in the US

Ondo Finance today announced the first live solution of third-party tokenized U.S. securities operating entirely within the existing regulatory perimeter in the U.S., in partnership with Broadridge Financial Solutions Inc., (NYSE: BR) to provide full voting rights for tokenized equity holders.

Finextra