The ProfileGrid – User Profiles, Groups and Communities plugin for WordPress contains a missing capability check in the pg_delete_msg() function. Because the function does not verify that the requesting user has permission to delete the targeted message, a user with any authenticated role of Subscriber or higher can delete arbitrary messages belonging to other users. This flaw violates data integrity and is classified as CWE‑862, Missing Authorization Check.

The vulnerability affects the metagauss ProfileGrid WordPress plugin, versions up to and including 5.9.8.1. All WordPress sites that install or use these plugin releases are impacted.

The CVSS score of 4.3 indicates moderate severity, while the EPSS score of less than 1% points to a low likelihood of exploitation. The vulnerability is not listed in CISA’s KEV catalog. An attacker must first authenticate as a Subscriber or higher role, then supply a valid message ID (mid) in a direct request to the deletion endpoint. No remote code execution or network-level exploit is required, making the attack vector internal to the WordPress installation.