{"id":"CVE-2026-12688","aliases":["EUVD-2026-48489","GHSA-pp2q-mfv3-q5wp"],"status":"published","title":"ProfileGrid \u003c 5.9.9.7 - Unauthenticated Payment Bypass and Forced Group Membership via PayPal IPN Forgery","description":"The ProfileGrid  WordPress plugin before 5.9.9.7 does not verify PayPal IPN notifications before granting paid group membership, allowing unauthenticated attackers to forge a payment notification and mark any user as a paid member of any group without any payment being made.","severity":{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-11","score":0.00275,"percentile":0.20119,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-284"],"published":"2026-07-24T06:00:02Z","modified":"2026-07-24T21:33:29Z","products":[{"vendor":"metagauss","product":"profilegrid"},{"vendor":"unknown","product":"profilegrid"}],"references":[{"url":"https://wpscan.com/vulnerability/b62a2c10-78da-4a7d-a6e1-f50ebf0763db/","tags":["exploit","vdb-entry","technical-description"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-12688"},{"url":"https://wpscan.com/vulnerability/b62a2c10-78da-4a7d-a6e1-f50ebf0763db"},{"url":"https://github.com/advisories/GHSA-pp2q-mfv3-q5wp"}],"sources":{"cve":[{"id":"CVE-2026-12688","title":"ProfileGrid \u003c 5.9.9.7 - Unauthenticated Payment Bypass and Forced Group Membership via PayPal IPN Forgery","description":"The ProfileGrid  WordPress plugin before 5.9.9.7 does not verify PayPal IPN notifications before granting paid group membership, allowing unauthenticated attackers to forge a payment notification and mark any user as a paid member of any group without any payment being made.","status":"published","published":"2026-07-24T06:00:02.508Z","modified":"2026-07-24T19:43:21.142Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium","assessor":"adp"}],"cwes":["CWE-284"],"updated_at":"2026-11-02T14:19:47.998488Z"}],"euvd":[{"id":"EUVD-2026-48489","description":"The ProfileGrid  WordPress plugin before 5.9.9.7 does not verify PayPal IPN notifications before granting paid group membership, allowing unauthenticated attackers to forge a payment notification and mark any user as a paid member of any group without any payment being made.","status":"published","published":"2026-07-24T06:00:02Z","modified":"2026-07-24T19:43:21Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T18:19:38.612768Z"}],"ghsa":[{"id":"GHSA-pp2q-mfv3-q5wp","title":"The ProfileGrid  WordPress plugin before 5.9.9.7 does not verify PayPal IPN notifications before...","description":"The ProfileGrid  WordPress plugin before 5.9.9.7 does not verify PayPal IPN notifications before granting paid group membership, allowing unauthenticated attackers to forge a payment notification and mark any user as a paid member of any group without any payment being made.","status":"published","published":"2026-07-24T09:32:14Z","modified":"2026-07-24T21:33:29Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-284"],"updated_at":"2026-11-02T15:09:48.807824Z"}],"nvd":[{"id":"CVE-2026-12688","description":"The ProfileGrid  WordPress plugin before 5.9.9.7 does not verify PayPal IPN notifications before granting paid group membership, allowing unauthenticated attackers to forge a payment notification and mark any user as a paid member of any group without any payment being made.","status":"published","published":"2026-07-24T07:16:32.473Z","modified":"2026-07-24T20:48:39.923Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-284"],"updated_at":"2026-11-02T14:12:32.473901Z"}]}}