CVE-2026-12690 – ProfileGrid < 5.9.9.7 – Subscriber+ Premium License Tampering via Missing Authorization

CVE ID :CVE-2026-12690

Published : July 24, 2026, 7:16 a.m. | 33 minutes ago

Description :The ProfileGrid WordPress plugin before 5.9.9.7 does not perform a capability check on its license management actions, relying only on a nonce that is exposed to any logged-in user, allowing authenticated users with Subscriber-level access and above to overwrite the site’s premium license settings.

Severity: 0.0 | NA

Visit the link for more details, such as CVSS details, affected products, timeline, and more…