Lucene search

K
wpvulndbWpvulndbWPVDB-ID:BC0C2800-5694-4D2C-9AEF-077210420AEB
HistoryMay 03, 2024 - 12:00 a.m.

ProfileGrid < 5.8.3 - Bypass Group Members Limit

2024-05-0300:00:00
wpscan.com
3
profilegrid
wordpress
vulnerability
group limit
bypass
authentication

4.3 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

6.8 Medium

AI Score

Confidence

Low

0.0004 Low

EPSS

Percentile

9.0%

Description The ProfileGrid – User Profiles, Memberships, Groups and Communities plugin for WordPress is vulnerable to group limit bypass in all versions up to, and including, 5.8.2. This is due to the plugin not properly verifying the limits of a group before adding a member. This makes it possible for authenticated attackers, with subscriber-level access and above, to bypass group limits.

CPENameOperatorVersion
eq5.8.3

4.3 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

6.8 Medium

AI Score

Confidence

Low

0.0004 Low

EPSS

Percentile

9.0%

Related for WPVDB-ID:BC0C2800-5694-4D2C-9AEF-077210420AEB