cve.bz

CVE-2026-12690

3.8 lowEPSS 0.3%

Low (3.8). EPSS 0.3% chance of exploitation in the next 30 days.

The ProfileGrid WordPress plugin before 5.9.9.7 does not perform a capability check on its license management actions, relying only on a nonce that is exposed to any logged-in user, allowing authenticated users with Subscriber-level access and above to overwrite the site's premium license settings.

Severity

CVSS 3.1

3.8 low
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N
EPSS
0.3% chance of exploitation in the next 30 days; higher than 17% of CVEs (scores of 2026-10-31)
CWE
CWE-862
Published
Modified
Record from
the NVD, synced

References

Check your stackJSON