← CVE Intelligence

CVE-2026-16291

ProfileGrid < 5.9.9.8 - Subscriber+ Arbitrary Notification Deletion via IDOR PUBLISHED

Description (CNA)

The ProfileGrid WordPress plugin before 5.9.9.8 does not verify that a notification belongs to the requesting user before deleting it, allowing any authenticated user such as a Subscriber to delete other users' notifications by enumerating notification identifiers.

Affected (CNA)

Vendor / productVersions
Unknown / ProfileGridaffected 0 before 5.9.9.8

CWE

No CWE identifiers supplied.

References

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.