This vulnerability is a cross‑site request forgery flaw that allows an unauthenticated attacker to cause an administrator to approve or deny user requests to join a group. The flaw exists because the plugin’s membership request management page does not validate a required nonce token. If an attacker can entice an admin to click a crafted link, the admin’s browser will send a forged request that changes the approval state, potentially giving a malicious user access to restricted group content.

The issue affects the WordPress plugin ProfileGrid – User Profiles, Groups and Communities. All versions up to and including 5.9.8.2 are vulnerable; newer releases are not mentioned in the advisory.

The CVSS base score of 4.3 indicates moderate severity, but the EPSS score of less than 1% shows a low likelihood of exploitation under normal circumstances. The vulnerability requires social engineering, as the attacker must persuade a site administrator to perform a specific action, such as clicking a link. Even with edge‑case exploitation, the damage is limited to unauthorized group membership decisions rather than arbitrary code execution or data exfiltration. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.