ProfileGrid accepts forged PayPal membership notifications
ProfileGrid before 5.9.9.7 processes an unauthenticated action=ipn request on a published group page without validating it with PayPal. Attacker-controlled payment_status and custom values reach the membership handler, allowing any selected user ID to be marked as a paid member of any selected group even when the amount, receiver and transaction were not legitimate.
- Component
- ProfileGrid
- Affected
- < 5.9.9.7
- Safe version
5.9.9.7- Published
- Jul 24, 2026
This CVE was published Jul 24, 2026 and is one of 55 known issues for this plugin.
Update, patch or deactivate.
Update ProfileGrid to 5.9.9.7 or later. A proper backport must validate the complete IPN with PayPal and verify the configured receiver, expected amount and currency, unique transaction ID, selected user and group before writing membership or payment metadata. Disable paid-group PayPal processing if an immediate update is impossible.
A safe version is available, so updating to that version or later is the preferred remediation. If an immediate update is not practical, consider a targeted application patch or temporarily restricting the affected functionality.
Deactivate only when warranted by your risk profile, or when advised by your hosting provider in the limited circumstances where the vulnerability cannot otherwise be mitigated. If you’re unsure which action is appropriate, contact Fused or your hosting provider for guidance.
Technical description
The ProfileGrid WordPress plugin before 5.9.9.7 does not verify PayPal IPN notifications before granting paid group membership, allowing unauthenticated attackers to forge a payment notification and mark any user as a paid member of any group without any payment being made.
CVE / CNA vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N