Authorization Bypass in ProfileGrid WordPress Plugin

Executive Summary

The ProfileGrid WordPress plugin before version 6.0.0.0 has a vulnerability where it fails to check user permissions when displaying pending membership requests for groups. This allows any logged-in user, even those with minimal access like Subscribers, to view the names and request dates of users waiting to join any group, including private ones.

Useful 0 Not Useful 0

Detection Guidance

Check WordPress sites running ProfileGrid plugin versions before 6.0.0.0. Inspect network traffic for unauthorized requests to /wp-json/profilegrid/v1/groups/{group_id}/pending-members. Review server logs for repeated access to membership endpoints by low-privilege users.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability could expose sensitive information about group memberships. Attackers might use this to identify potential targets, gather intelligence on private groups, or prepare for further attacks by knowing who is trying to join restricted groups.

Useful 0 Not Useful 0

Mitigation Strategies

Update ProfileGrid plugin to version 6.0.0.0 or later immediately. Implement strict access controls to restrict endpoint access. Monitor for unauthorized group membership disclosures and audit user permissions.

Useful 0 Not Useful 0