CVE-2026-12690

LOW3.8

Published 2026-07-24 · Updated 2026-07-24 · Source contact@wpscan.com

Description

The ProfileGrid WordPress plugin before 5.9.9.7 does not perform a capability check on its license management actions, relying only on a nonce that is exposed to any logged-in user, allowing authenticated users with Subscriber-level access and above to overwrite the site's premium license settings.

CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N

CWE-862

References

https://wpscan.com/vulnerability/7a1fc208-851b-4eb6-a332-fbef57181755/

View on NVD

Related CVEs

Same severity, most recent

CVE-2026-66011
ImageMagick before 7.1.2-27 contains a memory leak vulnerability in the magick command-line interface when invalid options are provided. Attackers can trigger memory exhaustion by repeatedly supplying malformed command-line arguments to consume system resources.
2026-07-25 · score 3.3
CVE-2026-17039
A flaw was found in pki-core. The certificate authority (CA) renewal request path does not perform the realm-based authorization check that the enrollment path performs, allowing an authenticated user entitled to one realm to cause a certificate belonging to a different realm to be renewed without that realm's authorization.
2026-07-24 · score 3.1
CVE-2026-15687
A security issue was discovered in the Kubernetes Java client library where a compromised pod may be able to create new files in arbitrary locations on the client machine executing copy operations via non-tar copyDirectoryFromPod when enableTarCompressing is false.
2026-07-23 · score 2.4
CVE-2026-64800
In JetBrains GoLand before 2026.2 sensitive configuration values written to log files by default
2026-07-23 · score 3.5
CVE-2026-52686
The issue is a DNSSEC validation bypass where wildcard expansion proofs (NSEC/NSEC3 records) are accepted without signature validation when the wildcard answer is a CNAME or DNAME record.
2026-07-23 · score 3.7