The ProfileGrid WordPress plugin before version 6.0.0.0 fails to perform authorization checks before returning a group's member list. The handler is registered for unauthenticated requests, allowing any visitor to retrieve the members and identifiers of any group, including those that are private or closed. This results in a privacy breach where sensitive membership information is exposed without consent and bypasses the plugin’s intended visibility controls.

WordPress sites that have installed the ProfileGrid plugin with any version lower than 6.0.0.0 are affected. The vulnerability applies to all such installations, regardless of the number or type of groups present.

The flaw can be exploited by simply accessing a URL exposed by the plugin; no authentication or special privileges are required. The CVSS score of 5.3 indicates a moderate risk level, while the EPSS score of < 1% suggests a low probability of exploitation in the wild. The KEV status indicates it is not listed in CISA's Known Exploited Vulnerabilities catalog, so active exploitation is currently considered unlikely.