ProfileGrid – User Profiles, Memberships, Groups and Communities, CVE-2023-0940

CVE, Research URL: CVE-2023-0940
Home page URL: Security reports for ProfileGrid – User Profiles, Memberships, Groups and Communities
Application: ProfileGrid – User Profiles, Memberships, Groups and Communities
Published on: Mar 20, 2023
Research Description: The ProfileGrid WordPress plugin before 5.3.1 provides an AJAX endpoint for resetting a user password but does not implement proper authorization. This allows a user with low privileges, such as subscriber, to change the password of any account, including Administrator ones.
Affected versions: Min -, max 5.3.1.
Status: vulnerable