CVE-2026-16291: 
WordPress vulnerability analysis and mitigation

CVE-2026-16291 is an Insecure Direct Object Reference (IDOR) vulnerability in the ProfileGrid WordPress plugin (by Metagauss) that allows any authenticated user with at least Subscriber-level access to delete other users' notifications by enumerating notification identifiers. All versions of the plugin before 5.9.9.8 are affected. The vulnerability was publicly disclosed on July 21, 2026, and added to NVD on August 2, 2026. It carries a CVSS score of 4.3 (Medium) (WPScan, Github Advisory).

The root cause is a missing authorization check (CWE-639: Authorization Through User-Controlled Key) when processing notification deletion requests. The plugin fails to verify that the notification ID supplied in the request belongs to the authenticated user making the request, enabling any logged-in user to supply arbitrary notification IDs and delete notifications owned by other accounts. This is a classic IDOR (Insecure Direct Object Reference) pattern, classified under OWASP Top 10 A5: Broken Access Control. A proof-of-concept is expected to be published by WPScan on August 4, 2026, to allow time for users to update (WPScan).

Successful exploitation allows any authenticated user — including those with the lowest-privilege Subscriber role — to permanently delete notifications belonging to any other user on the WordPress site by iterating through notification identifiers. This results in an integrity impact through unauthorized data deletion and may disrupt user experience or hide important system or administrative notifications. The vulnerability does not directly enable data exfiltration, privilege escalation, or remote code execution, limiting its scope to notification data integrity (WPScan, Github Advisory).

1. Obtain authenticated access: Register or log in to the target WordPress site with any account, including a low-privilege Subscriber account.
2. Identify the notification deletion endpoint: Locate the AJAX action or REST API endpoint used by the ProfileGrid plugin to delete notifications (typically via browser developer tools or by inspecting plugin source code).
3. Capture a legitimate deletion request: Trigger a notification deletion for your own account and capture the HTTP request, noting the notification ID parameter.
4. Enumerate notification IDs: Modify the notification ID parameter in the request to sequential or guessed integer values corresponding to other users' notifications.
5. Delete arbitrary notifications: Submit the crafted requests to delete notifications belonging to other users; the plugin will process these without verifying ownership (WPScan).

• Logs: WordPress access logs showing repeated requests to the ProfileGrid notification deletion endpoint from a single low-privilege user account, with rapidly incrementing or varied notification ID values.
• Logs: Unusual volume of notification deletion events in WordPress debug or audit logs originating from Subscriber-level accounts.
• Application Behavior: Users reporting missing or unexpectedly deleted notifications without having taken any action themselves.

Update the ProfileGrid WordPress plugin to version 5.9.9.8 or later, which introduces proper ownership verification before processing notification deletion requests. No configuration-based workaround is available; upgrading is the only effective remediation. Site administrators should also review user accounts for any unauthorized Subscriber-level registrations that could be used to exploit this or similar vulnerabilities (WPScan, Github Advisory).

The vulnerability was discovered and reported by independent researcher Meher Sudhakar Abbireddi and verified by WPScan. No significant broader media coverage or notable community commentary beyond standard vulnerability database aggregation has been observed at this time (WPScan).