ProfileGrid – User Profiles, Memberships, Groups and Communities, CVE-2024-5453

CVE, Research URL: CVE-2024-5453
Home page URL: Security reports for ProfileGrid – User Profiles, Memberships, Groups and Communities
Application: ProfileGrid – User Profiles, Memberships, Groups and Communities
Published on: Jun 05, 2024
Research Description: The ProfileGrid – User Profiles, Groups and Communities plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the pm_dismissible_notice and pm_wizard_update_group_icon functions in all versions up to, and including, 5.8.6. This makes it possible for authenticated attackers, with Subscriber-level access and above, to change arbitrary options to the value '1' or change group icons.
Affected versions: Min -, max 5.8.7.
Status: vulnerable