CVE-2026-16289

The CVE covers ProfileGrid WordPress plugin versions before 6.0.0.0. The vulnerability is due to missing authorization checks when listing a group’s pending membership requests, allowing any authenticated user (e.g., a Subscriber) to disclose names and request dates of users awaiting approval to ...