https://vulnerability.circl.lu/rss/recent/all/10 Most recent entries from all 2026-10-08T18:33:57.439769+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent entries. https://vulnerability.circl.lu/vuln/cve-2026-12688 CVE-2026-12688 — ProfileGrid < 5.9.9.7 - Unauthenticated Payment Bypass and Forced Group Membership via PayPal IPN Forgery 2026-10-08T18:33:57.455402+00:00

Affected: Unknown ProfileGrid

The ProfileGrid WordPress plugin before 5.9.9.7 does not verify PayPal IPN notifications before granting paid group membership, allowing unauthenticated attackers to forge a payment notification and mark any user as a paid member of any group without any payment being made.