{"id":"CVE-2026-94663","published":"2026-10-09T10:16:41.283","lastModified":"2026-10-09T18:17:15.790","description":"Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Metagauss ProfileGrid profilegrid-user-profiles-groups-and-communities allows Blind SQL Injection.This issue affects ProfileGrid: from n/a through 6.0.0.2.","cvssScore":8.5,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L","cwes":["CWE-89"],"vendors":[],"products":[],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/profilegrid-user-profiles-groups-and-communities/vulnerability/wordpress-profilegrid-plugin-6-0-0-2-sql-injection-vulnerability?_s_id=cve","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"A SQL injection vulnerability in Metagauss ProfileGrid allows attackers with limited privileges to perform blind SQL injection attacks, potentially leading to unauthorized data access and system compromise.","exploitability":"Exploitation requires a user with limited privileges (PR:L) to interact with the application, making it moderately difficult but not impossible to achieve, especially in environments where users can be tricked into performing actions.","blast_radius":"If exploited, this vulnerability could allow attackers to extract sensitive data from the database, potentially including user credentials and personal information, affecting all users within the ProfileGrid system.","remediation":"Upgrade to ProfileGrid version 6.0.0.2 or later to remediate this SQL injection vulnerability.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["sql-injection","blind-sql","wordpress","plugin"],"model":"garnet-coder","analyzedAt":"2026-10-17T08:56:19.963Z"}}