Metagauss ProfileGrid: Blind SQL injection in WordPress plugin

Summary

The WordPress plugin ProfileGrid (user profiles, groups and communities) up to and including version 6.0.0.2 contains a blind SQL injection flaw (CWE-89). An attacker with a logged-in low-privilege account, such as a Subscriber, can send crafted requests to extract data from the site's database, which may include user accounts and private data. The CVSS score of 8.5 is the CNA's figure; NVD analysis is still pending.

Affected

• Metagauss ProfileGrid WordPress plugin, all versions up to and including 6.0.0.2
• Required privilege according to Patchstack: Subscriber

Fixed in

• Version 6.0.0.3 or later, according to the CVE record and the Patchstack page

Workaround

• No vendor workaround known.
• Deactivate the plugin if it is not business-critical.
• Restrict registration and review low-privilege accounts.
• Use a WAF or virtual patch in front of the site if available. Patchstack reports it has issued a mitigation rule.

Exploitation

• No evidence of exploitation in the wild found.
• CISA SSVC assessment: exploitation none, not automatable.
• Not listed in CISA KEV according to one aggregator; EPSS about 0.2%.
• No public proof of concept found.

Our recommendation

• Update the ProfileGrid plugin to version 6.0.0.3 or later as a priority.
• If an update is not possible right away, deactivate the plugin or apply a WAF/virtual patch.
• Review registration settings and remove unneeded Subscriber accounts.
• Inventory all WordPress sites running ProfileGrid and their versions.
• Monitor logs for unusual database errors or requests.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Patchstack advisory for ProfileGrid <= 6.0.0.2 patchstack.com
• Vulners record CVE-2026-94663 vulners.com
• Strix CVE-2026-94663 overview www.strix.ai
• OffSeq radar CVE-2026-94663 radar.offseq.com
• WPScan ProfileGrid plugin wpscan.com
• WP-Firewall advisory CVE-2026-4608 (earlier ProfileGrid SQL injection) wp-firewall.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 11:05.