Critical Privilege Escalation Vulnerability in ProfileGrid Plugin for WordPress

ProfileGrid (<= 5.9.9.5) for WordPress contains a critical privilege escalation flaw allowing unauthenticated attackers to change the admin email and reset the administrator password, resulting in full admin account takeover (CVSS 9.8). Administrators should update or disable the plugin immediately; no public proof-of-concept or active exploitation has been reported as of publication (June 30, 2026).