The vulnerability is a PHP Object Injection flaw in the ProfileGrid plugin’s get_user_meta_fields_html function. An authenticated user with the Subscriber role or higher can supply crafted serialized data that is deserialized without proper validation. The plugin itself does not contain a predefined PHP Object Playground (POP) chain, so the flaw cannot directly execute code. However, if another plugin or theme on the same WordPress installation includes a POP chain, the attacker can leverage that chain to delete files, read sensitive data, or run arbitrary code.

All WordPress sites running any version of the ProfileGrid – User Profiles, Groups and Communities plugin up to and including 5.9.4.5 are affected. The risk applies only to sites where a vulnerable POP chain is also present, such as unpatched themes or third‑party plugins that deserialize user input.

The CVSS score of 8.8 indicates a high severity scenario. The EPSS score is below 1%, suggesting the exploitation likelihood is currently low, and the vulnerability is not listed in the CISA KEV catalog. Nonetheless, the flaw is exploitable by anyone with Subscriber or greater access and requires only that the site host an additional plugin or theme that contains a PHP Object Injection POP chain. Should such a chain exist, the impact can rise to full code execution or arbitrary file modification.