CVE-2026-12688

The CVE describes a vulnerability in the ProfileGrid WordPress plugin prior to version 5.9.9.7 where PayPal IPN notifications are not verified before granting paid group membership. This allows unauthenticated attackers to Forge a payment notification and set any user as a paid member of any grou...

EUVD-2026-48489

The ProfileGrid WordPress plugin before 5.9.9.7 does not verify PayPal IPN notifications before granting paid group membership, allowing unauthenticated attackers to forge a payment notification and mark any user as a paid member of any group without any payment being made...