CVE-2026-2488: ProfileGrid <= 5.9.8.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Message Deletion
Vulnerability summary
CVE-2026-2488 is a medium (CVSS 4.3) Missing Authorization vulnerability in metagauss profilegrid – user profiles, groups and communities. EPSS estimates a 0.22% chance of exploitation in the next 30 days, higher than 12.2% of scored vulnerabilities. Fixed in 5.9.8.2.
Timeline
- 07-03-2026PublishedVulnerability first disclosed.
- 08-04-2026Last modifiedVulnerability information updated.
Description
The ProfileGrid – User Profiles, Groups and Communities plugin for WordPress is vulnerable to unauthorized message deletion due to a missing capability check on the pg_delete_msg() function in all versions up to, and including, 5.9.8.1. This is due to the function not verifying that the requesting user has permission to delete the targeted message. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete arbitrary messages belonging to any user by sending a direct request with a valid message ID (mid parameter).
CVSS metrics
3 scores · 3 sources · 1 version- NVDNIST4.3MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
- wordfenceSource4.3MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
EPSS trend
Probability
0.22%
Chance of exploitation in the next 30 days
Percentile
12%
Versus all other CVEs
30-day change
No change 0.00 pp
From 0.22% on 22-09-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Metagauss1 product
Wordpress1 product
- profilegrid-user-profiles-groups-and-communities≤ 5.9.8.1 (fixed in 5.9.8.2)
2 vendors · 2 products