CVE-2025-13416

Name of the Vulnerable Software and Affected Versions ProfileGrid – User Profiles, Groups and Communities plugin for WordPress versions through 5.9.7.2

Description The ProfileGrid plugin for WordPress is susceptible to unauthorized user suspension. This occurs because of a missing capability check within the pm deactivate user from group() function. Authenticated attackers with Subscriber-level access or higher can suspend any user from groups, potentially including administrators, by utilizing the pm deactivate user from group AJAX action.

Recommendations Update to a version beyond 5.9.7.2.