ProfileGrid < 5.5.3 - Group Owner+ Unauthorized Data Modification

2023-07-1800:00:00

wpscan.com

profilegrid

unauthorized data modification

group owner

data security

6.8 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

29.2%

JSON

Description The plugin does not adequately check capabilities on the ‘edit_group’ handler, enabling authenticated users with group ownership to improperly update group options, including the ‘associate_role’ parameter, which sets the member’s role.

CPENameOperatorVersion
profilegrid-user-profiles-groups-and-communitieseq5.5.3

CPE	Name	Operator	Version
	profilegrid-user-profiles-groups-and-communities	eq	5.5.3

References

www.wordfence.com/threat-intel/vulnerabilities/id/a4766651-92a6-42c9-81bc-7ea25350f561