The vulnerability, classified as an Insecure Direct Object Reference (CWE‑639), exists because ProfileGrid does not confirm that a notification scheduled for deletion actually belongs to the user making the request. This means an authenticated user can delete any notification simply by supplying its identifier, sacrificing the integrity of other users’ data. The immediate consequence is loss or tampering of notification content, potentially exposing sensitive information or disrupting communications.

This flaw affects installations of the ProfileGrid WordPress plugin version prior to 5.9.9.8. Any WordPress site that has this plugin deployed, regardless of vendor, is at risk if the plugin has not been upgraded to the patched release.

The EPSS score of fewer than 1 % indicates a very low probability of exploitation, and the vulnerability is not listed in CISA's KEV catalog. However, the flaw requires only an authenticated user, and subscribers can enumerate notification IDs, so the attack can be carried out for any site that has exposed the deletion endpoint. The CVSS score is 4.3, indicating low severity, but the impact on application integrity is still significant enough to warrant prompt attention.