Authenticated License Overwrite in ProfileGrid WordPress Plugin

Executive Summary

This vulnerability affects the ProfileGrid WordPress plugin versions before 5.9.9.7. It allows authenticated users with Subscriber-level access or higher to tamper with premium license settings due to a missing authorization check. The plugin relies only on a nonce for security, which is exposed to all logged-in users, enabling attackers to harvest it and perform unauthorized actions.

Useful 0 Not Useful 0

Detection Guidance

Check if the ProfileGrid plugin version is below 5.9.9.7 by inspecting the WordPress admin panel or running a command like 'wp plugin list' in the WordPress directory. Look for exposed nonces in wp-admin pages by viewing page source or using browser developer tools.

Useful 0 Not Useful 0

Impact Analysis

An attacker could log in as a Subscriber, retrieve the exposed nonce, and use it to deactivate or overwrite the site's premium license via crafted requests. This could allow the license to be replaced with an attacker-controlled value or arbitrary license options, though core WordPress settings remain unaffected.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability primarily affects access control rather than directly violating GDPR or HIPAA. However, unauthorized changes to license settings could indirectly impact compliance by altering plugin functionality that handles user data or permissions. For example, if the license change affects a premium feature storing sensitive user information, it might create compliance gaps. The risk is limited as the flaw does not allow direct manipulation of core settings like user roles or configurations.

Useful 0 Not Useful 0

Mitigation Strategies

Update the ProfileGrid plugin to version 5.9.9.7 or later immediately. If updating is not possible, consider disabling the plugin until an update is applied. Review user roles to ensure only necessary permissions are granted.

Useful 0 Not Useful 0