CVE-2024-3606 - ProfileGrid – User Profiles, Memberships, Groups and Communities <= 5.8.3

Back Back to CVE browser

MEDIUM

ProfileGrid – User Profiles, Memberships, Groups and Communities <= 5.8.3 - Missing Authorization

Published May 2, 2024

4.3

MEDIUM

CVSS 3.1

EPSS 0.45%

Description

The ProfileGrid – User Profiles, Memberships, Groups and Communities plugin for WordPress is vulnerable to unauthorized deletion of data due to a missing capability check on the pm_upload_cover_image function in all versions up to, and including, 5.8.3. This makes it possible for authenticated attackers, with subscriber access or higher, to delete attachments.

Affected products

Vendor Metagauss Product ProfileGrid – User Profiles, Groups and Communities Default
unaffected
- Version
  0
  Status
  affected
  Constraints
  <=5.8.3

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Metagauss

ProfileGrid – User Profiles, Groups and Communities

unaffected

Version	Status	Constraints
0	affected	<=5.8.3

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-862

Missing Authorization

References (3)

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2024-32185		Advisory
https://plugins.trac.wordpress.org/changeset/3069928/profilegrid-user-profiles-groups-and-communities/trunk?contextall=1&old=3068943&old_path=%2Fprofilegrid-user-profiles-groups-and-communities%2Ftrunk		Patch
https://www.wordfence.com/threat-intel/vulnerabilities/id/c039d2fe-7518-4724-a025-6380a53fb58c?source=cve		Third Party Advisory