The vulnerability in the WordPress ProfileGrid plugin is an insecure direct object reference that lets an attacker guess or manipulate numeric identifiers to access or edit other users’ profiles, groups, or community data. This forms an authorization bypass, possibly exposing confidential user information or allowing the attacker to modify content they should not control. The weakness is classified as CWE‑639, indicating that improper handling of user‐controlled keys can lead to privilege escalation.

WordPress installations using the Metagauss ProfileGrid plugin version 6.0.0.2 or earlier are affected. The plugin is distributed by the vendor Metagauss under the name "ProfileGrid."

The CVSS base score of 5.3 places this vulnerability in the medium severity range. Because the EPSS score is not available, the current likelihood of exploitation is unknown, but the vulnerability is not listed in the CISA KEV catalog. Inferred attack vectors include remote exploitation via the WordPress web interface; an attacker with access to the site’s public pages could tamper with ID parameters to reach restricted data. Given the availability of a remediation path, the risk can be mitigated by applying the vendor’s patch.