The vulnerability is a Cross‑Site Request Forgery flaw (CWE‑352) present in all releases of the ProfileGrid plugin up to version 6.0.0.2. Because the plugin lacks verification of an authenticated nonce for state‑changing requests, an attacker can direct a victim’s browser to execute unintended actions while the victim is logged in. This can enable the attacker to perform any operation that the victim can normally do, potentially compromising account integrity. Based on the description, it is inferred that the plugin fails to validate an access token or nonce that would normally prevent such abuse.

The plugin is distributed by Metagauss under the ProfileGrid name. All WordPress sites running the ProfileGrid plugin version 6.0.0.2 or earlier are vulnerable. Any system with that code can be affected.

The CVSS score of 8.8 classifies this as a high‑severity issue. The EPSS score of <1% indicates a low likelihood of exploitation, although the possibility exists. The vulnerability is not listed in CISA’s KEV catalog. The attack vector likely involves a victim’s browser inadvertently sending a crafted request—such as clicking a malicious link—while carrying a valid session cookie, allowing the unauthenticated CSRF to succeed.