Signal is active with 2 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
The ProfileGrid – User Profiles, Groups and Communities plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.9.7.2 via the 'pm_upload_image' and 'pm_upload_cover_image' AJAX actions. This is due to the update_user_meta() function being called outside of the user authorization check in public/partials/crop.php and public/partials/coverimg_crop.php. This makes it possible for authenticated attackers, with Subscriber-level access and above, to change any user's profile picture or cover image, including administrators.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
CVE-2026-1271 Insecure Direct Object Reference in ProfileGrid WordPress Plugin Versions ≤ 5.9.7.2 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-1271
Post summary
A disclosed IDOR vulnerability affecting ProfileGrid WordPress plugin versions up to 5.9.7.2, with no PoC, exploit, or patch details provided.
CVE-2026-1271 The ProfileGrid – User Profiles, Groups and Communities plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.9… https://www.cve.org/CVERecord?id=CVE-2026-1271
Post summary
The ProfileGrid WordPress plugin is vulnerable to an IDOR flaw in all versions up to 5.9; no PoC, exploit, patch, or active exploitation information is provided.