ProfileGrid private-message actions permit cross-user tampering
ProfileGrid before 5.9.9.7 allows any authenticated user, including a Subscriber, to call the pm_messenger_delete_threads and pm_messages_mark_as_read AJAX actions for another user's numeric thread ID. The handlers do not verify thread participation or ownership, allowing a nonparticipant to soft-delete a victim thread, write attacker-selected deletion metadata and mark its messages as read.
- Component
- ProfileGrid
- Affected
- < 5.9.9.7
- Safe version
5.9.9.7- Published
- Jul 24, 2026
- Weakness
- CWE-862 — Missing Authorization
This CVE was published Jul 24, 2026 and is one of 55 known issues for this plugin.
Update, patch or deactivate.
Update ProfileGrid to 5.9.9.7 or later. A source backport must load the requested thread and reject the mutation unless the current user is a participant; action-specific nonce checks should supplement, not replace, that object-level authorization. The flaw does not disclose message bodies through these actions.
A safe version is available, so updating to that version or later is the preferred remediation. If an immediate update is not practical, consider a targeted application patch or temporarily restricting the affected functionality.
Deactivate only when warranted by your risk profile, or when advised by your hosting provider in the limited circumstances where the vulnerability cannot otherwise be mitigated. If you’re unsure which action is appropriate, contact Fused or your hosting provider for guidance.
Technical description
The ProfileGrid WordPress plugin before 5.9.9.7 does not perform any authorization or ownership check on some of its private-message thread actions, allowing authenticated users with Subscriber-level access and above to soft-delete, tamper with the metadata of, and mark as read other users' private message threads.
CVE / CNA vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L