The vulnerability in the ProfileGrid WordPress plugin allows any authenticated user with Subscriber-level privileges or higher to perform private‑message thread actions without proper authorization. Attackers can soft‑delete, alter metadata, and mark message threads as read for other users. This can eliminate or obscure legitimate communications, leading to loss of data and privacy breaches. The weakness is a missing authorization check (CWE‑862).

The flaw affects installations of the ProfileGrid WordPress plugin earlier than version 5.9.9.7 on any WordPress site. No other vendors are listed. Sites running these older versions are vulnerable.

The CVSS score of 5.4 indicates moderate severity. The EPSS score is below 1%, reflecting a very low current exploitation probability. The vulnerability is not in the CISA KEV catalog. Exploitation requires the user to be authenticated; no network‑level access is needed. An attacker can use a Subscriber account to delete or tamper with other users’ private message threads, potentially covering tracks or deleting evidence.