ProfileGrid <= 6.0.0.2 - Unauthenticated Sensitive Information Exposure via Blog Post Listing AJAX Actions
- ID
- WPSEC-2026-0056
- Plugin
- ProfileGrid – User Profiles, Groups and Communities (profilegrid-user-profiles-groups-and-communities)
- Affected
- all versions before 6.0.0.3
- Remediation
- Update to 6.0.0.3 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
- Weakness
- CWE-200
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-10-22
- Attack surface
- ProfileGrid on WPSec AttackSurface
- Fix released
- Published
Description
The User Profiles, Groups and Communities plugin for WordPress is vulnerable to Sensitive Information Exposure via the pm_load_pg_blogs and pm_load_user_blogs_shortcode_posts AJAX actions in all versions up to, and including, 6.0.0.2. This is due to the blog listings not applying the plugin's content access restrictions (such as group-only or friends-only) and accepting arbitrary post types. This makes it possible for unauthenticated attackers to view the titles, excerpts and featured images of posts the site owner restricted to specific groups or friends, and of published posts of non-public post types.
References
- https://wpsec.com/vuln/WPSEC-2026-0056/
- https://plugins.svn.wordpress.org/profilegrid-user-profiles-groups-and-communities/tags/6.0.0.3/
- https://wordpress.org/plugins/profilegrid-user-profiles-groups-and-communities/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS