CVE-2026-12689

The CVE concerns the ProfileGrid WordPress plugin (pre-5.9.9.7) where a missing authorization/ownership check allows authenticated users with Subscriber-level access and above to perform actions on other users’ private-message threads. Affected actions include soft-deleting threads, tampering wit...