CVE-2026-12688

ProfileGrid < 5.9.9.7 - Unauthenticated Payment Bypass and Forced Group Membership via PayPal IPN Forgery

Medium · published July 24, 2026

CVSS v3.1
6.5
EPSS
0%
Percentile
18.9
In the wild
Unconfirmed
What it is

The ProfileGrid WordPress plugin before 5.9.9.7 does not verify PayPal IPN notifications before granting paid group membership, allowing unauthenticated attackers to forge a payment notification and mark any user as a paid member of any group without any payment being made.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00275 · 18.9th percentile
Published
2026-07-24T06:00Z
EPSS history
Timeline
  • 24 JUL 06:00Z
    ProfileGrid < 5.9.9.7 - Unauthenticated Payment Bypass and Forced Group Membership via PayPal IPN Forgery
    cvelistv5