The vulnerability resides in the ProfileGrid WordPress plugin prior to version 5.9.9.8. It allows unauthenticated visitors to register into any group defined in the plugin's front‑end registration form. If the targeted group has a privileged role assigned—potentially even the Administrator role—an attacker can elevate privileges without authentication. This flaw is a classic Example of CWE‑269: Privilege‑Level Escalation via Inadequate Authorization.

Systems running the ProfileGrid WordPress plugin with a version earlier than 5.9.9.8 are vulnerable. The plugin’s front‑end registration feature can be accessed by any internet user, so any site using this plugin without a forced authentication step for group registration is impacted.

The CVSS score of 7.5 indicates a high severity and the abrupt ability to gain administrator privileges suggests a serious impact. The EPSS score of less than 1% indicates that current exploit activity is expected to be very low, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires only access to the public registration page and the selection of an appropriate group; no prerequisites such as site‑specific configuration or pre‑existing accounts are required. As it is a front‑end, unauthenticated attack vector, it is likely inexpensive for attackers to use on a widespread scale if a trusted group exists on a target site.