ProfileGrid <= 6.0.0.2 - Authenticated (Subscriber+) SQL Injection via Group IDs
- ID
- WPSEC-2026-0060
- Plugin
- ProfileGrid – User Profiles, Groups and Communities (profilegrid-user-profiles-groups-and-communities)
- Affected
- all versions before 6.0.0.3
- Remediation
- Update to 6.0.0.3 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
- Weakness
- CWE-89
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-10-22
- Attack surface
- ProfileGrid on WPSec AttackSurface
- Fix released
- Published
Description
The User Profiles, Groups and Communities plugin for WordPress is vulnerable to SQL Injection via group IDs in all versions up to, and including, 6.0.0.2. This is due to the 'pg_join_gid' value submitted when joining a group being stored unvalidated in the pm_group user meta and later concatenated into IN() clauses without integer casting, with the additional query parameter filter relying only on a keyword blocklist. This makes it possible for authenticated attackers with subscriber-level access to append additional conditions to existing queries on the plugin's own tables and alter the results returned, such as profile fields and sections.
References
- https://wpsec.com/vuln/WPSEC-2026-0060/
- https://plugins.svn.wordpress.org/profilegrid-user-profiles-groups-and-communities/tags/6.0.0.3/
- https://wordpress.org/plugins/profilegrid-user-profiles-groups-and-communities/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS