Vulnerabilities CVE-2026-12689

CVE-2026-12689

None

Open

TLP:CLEAR

ProfileGrid < 5.9.9.7 - Subscriber+ Cross-User Private Message Thread Deletion and Tampering via Missing Authorization

NVD CVE.org

AI Analysis

No AI analysis yet.

Description

The ProfileGrid WordPress plugin before 5.9.9.7 does not perform any authorization or ownership check on some of its private-message thread actions, allowing authenticated users with Subscriber-level access and above to soft-delete, tamper with the metadata of, and mark as read other users' private message threads.

Details

EPSS Score ⓘ: 0.14%

3.6th percentile
Confidence: 90%
Published: Jul 24, 2026
Last Modified: Jul 24, 2026

Notes

No notes yet. Click "Add Note" to create the first analysis note.

Opinions

No opinions yet. Be the first to assess this intelligence.