CVE-2026-2494

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-2494", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2026-02-13T21:16:27.567Z", "datePublished": "2026-03-07T01:21:22.065Z", "dateUpdated": "2026-04-08T16:59:02.356Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:59:02.356Z"}, "affected": [{"vendor": "metagauss", "product": "ProfileGrid \u2013 User Profiles, Groups and Communities", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "5.9.8.2", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The ProfileGrid \u2013 User Profiles, Groups and Communities plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 5.9.8.2. This is due to missing nonce validation on the membership request management page (approve and decline actions). This makes it possible for unauthenticated attackers to approve or deny group membership requests via a forged request granted they can trick a site administrator into performing an action such as clicking on a link."}], "title": "ProfileGrid <= 5.9.8.2 - Cross-Site Request Forgery to Group Membership Request Approval/Denial", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/6b8ffdb9-b8c6-428c-a047-8e5286b2c2fb?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/profilegrid-user-profiles-groups-and-communities/trunk/admin/partials/pm-membership-requests.php#L14"}, {"url": "https://plugins.trac.wordpress.org/browser/profilegrid-user-profiles-groups-and-communities/tags/5.9.7.1/admin/partials/pm-membership-requests.php#L14"}, {"url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3472582%40profilegrid-user-profiles-groups-and-communities&new=3472582%40profilegrid-user-profiles-groups-and-communities&sfp_email=&sfph_mail="}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-352 Cross-Site Request Forgery (CSRF)", "cweId": "CWE-352", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N", "baseScore": 4.3, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Sergej Ljubojevic"}, {"lang": "en", "type": "finder", "value": "Boris Bogosavac"}], "timeline": [{"time": "2026-02-18T21:12:14.000Z", "lang": "en", "value": "Vendor Notified"}, {"time": "2026-03-06T11:37:07.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-09T19:00:17.062036Z", "id": "CVE-2026-2494", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-09T19:33:58.929Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-2494", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-09T19:00:17.062036Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-09T19:00:18.419Z"}}], "cna": {"title": "ProfileGrid <= 5.9.8.2 - Cross-Site Request Forgery to Group Membership Request Approval/Denial", "credits": [{"lang": "en", "type": "finder", "value": "Sergej Ljubojevic"}, {"lang": "en", "type": "finder", "value": "Boris Bogosavac"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 4.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"}}], "affected": [{"vendor": "metagauss", "product": "ProfileGrid \u2013 User Profiles, Groups and Communities", "versions": [{"status": "affected", "version": "*", "versionType": "semver", "lessThanOrEqual": "5.9.8.2"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2026-02-18T21:12:14.000Z", "value": "Vendor Notified"}, {"lang": "en", "time": "2026-03-06T11:37:07.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/6b8ffdb9-b8c6-428c-a047-8e5286b2c2fb?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/profilegrid-user-profiles-groups-and-communities/trunk/admin/partials/pm-membership-requests.php#L14"}, {"url": "https://plugins.trac.wordpress.org/browser/profilegrid-user-profiles-groups-and-communities/tags/5.9.7.1/admin/partials/pm-membership-requests.php#L14"}, {"url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3472582%40profilegrid-user-profiles-groups-and-communities&new=3472582%40profilegrid-user-profiles-groups-and-communities&sfp_email=&sfph_mail="}], "descriptions": [{"lang": "en", "value": "The ProfileGrid \u2013 User Profiles, Groups and Communities plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 5.9.8.2. This is due to missing nonce validation on the membership request management page (approve and decline actions). This makes it possible for unauthenticated attackers to approve or deny group membership requests via a forged request granted they can trick a site administrator into performing an action such as clicking on a link."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-352", "description": "CWE-352 Cross-Site Request Forgery (CSRF)"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-03-07T01:21:22.065Z"}}}, "cveMetadata": {"cveId": "CVE-2026-2494", "state": "PUBLISHED", "dateUpdated": "2026-03-09T19:33:58.929Z", "dateReserved": "2026-02-13T21:16:27.567Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2026-03-07T01:21:22.065Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "ProfileGrid \u2013 User Profiles, Groups and Communities", "vendor": "metagauss", "versions": [{"lessThanOrEqual": "5.9.8.2", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The ProfileGrid \u2013 User Profiles, Groups and Communities plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 5.9.8.2. This is due to missing nonce validation on the membership request management page (approve and decline actions). This makes it possible for unauthenticated attackers to approve or deny group membership requests via a forged request granted they can trick a site administrator into performing an action such as clicking on a link."}, {"lang": "es", "value": "El plugin ProfileGrid \u2013 User Profiles, Groups and Communities para WordPress es vulnerable a la falsificaci\u00f3n de petici\u00f3n en sitios cruzados en todas las versiones hasta la 5.9.8.2, inclusive. Esto se debe a la falta de validaci\u00f3n de nonce en la p\u00e1gina de gesti\u00f3n de solicitudes de membres\u00eda (acciones de aprobaci\u00f3n y rechazo). Esto hace posible que atacantes no autenticados aprueben o denieguen solicitudes de membres\u00eda de grupo a trav\u00e9s de una petici\u00f3n falsificada, siempre que puedan enga\u00f1ar a un administrador del sitio para que realice una acci\u00f3n, como hacer clic en un enlace."}], "id": "CVE-2026-2494", "lastModified": "2026-06-17T10:31:09.937", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 1.4, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-2494", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-03-09T19:00:17.062036Z", "version": "2.0.3"}}]}, "published": "2026-03-07T02:16:12.787", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/profilegrid-user-profiles-groups-and-communities/tags/5.9.7.1/admin/partials/pm-membership-requests.php#L14"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/profilegrid-user-profiles-groups-and-communities/trunk/admin/partials/pm-membership-requests.php#L14"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3472582%40profilegrid-user-profiles-groups-and-communities&new=3472582%40profilegrid-user-profiles-groups-and-communities&sfp_email=&sfph_mail="}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/6b8ffdb9-b8c6-428c-a047-8e5286b2c2fb?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-352"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,5.9.8.2]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "ProfileGrid \u2013 User Profiles, Groups and Communities", "source": "cna", "vendor": "metagauss"}, "product": "profilegrid_\u2013_user_profiles,_groups_and_communities", "vendor": "metagauss"}, {"configurations": [{"platform": null, "status": "unaffected", "versions": null}], "enrichment": {"confidence": 80.0, "confidence_source": "inferred", "scores": [{"score": 80.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "product": "wordpress", "vendor": "wordpress"}], "analysis": {"en": {"generated_at": "2026-04-15T19:52:26.697303+00:00", "value": {"mitigation_remediation": ["Update to the latest ProfileGrid plugin version (5.9.8.3 or newer) to eliminate the CSRF flaw.", "If an update cannot be applied immediately, restrict the use of administrative accounts and apply additional authentication checks on the approval and decline actions.", "Enable monitoring or alerts for abnormal approval/denial activity to detect potential abuse."], "summary": {"action": "Update Plugin", "impact": "Unauthorized group membership modification"}, "threat_synthesis": {"affected_systems": "The issue affects the WordPress plugin ProfileGrid \u2013 User Profiles, Groups and Communities. All versions up to and including 5.9.8.2 are vulnerable; newer releases are not mentioned in the advisory.", "description_and_impact": "This vulnerability is a cross\u2011site request forgery flaw that allows an unauthenticated attacker to cause an administrator to approve or deny user requests to join a group. The flaw exists because the plugin\u2019s membership request management page does not validate a required nonce token. If an attacker can entice an admin to click a crafted link, the admin\u2019s browser will send a forged request that changes the approval state, potentially giving a malicious user access to restricted group content.", "risk_and_exploitability": "The CVSS base score of 4.3 indicates moderate severity, but the EPSS score of less than 1% shows a low likelihood of exploitation under normal circumstances. The vulnerability requires social engineering, as the attacker must persuade a site administrator to perform a specific action, such as clicking a link. Even with edge\u2011case exploitation, the damage is limited to unauthorized group membership decisions rather than arbitrary code execution or data exfiltration. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog."}}}}, "created": "2026-03-09T10:06:07.827986+00:00", "updated": "2026-04-15T20:00:06.616334+00:00", "vendors": ["metagauss", "metagauss$PRODUCT$profilegrid_\u2013_user_profiles,_groups_and_communities", "wordpress", "wordpress$PRODUCT$wordpress"]}