CVE-2023-3403 MEDIUM

CVE-2023-3403: ProfileGrid <= 5.5.1 - Missing Authorization to User Import

Vendor Metagauss
Product ProfileGrid – User Profiles, Groups and Communities
Weakness CWE-862 · Missing authorization
Published July 18, 2023
Last update April 8, 2026
View on NVD All CVEs

CVSS base score

5.4/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality None
Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

What the vulnerability does

01Description

The ProfileGrid plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'pm_upload_csv' function in versions up to, and including, 5.5.1. This makes it possible for authenticated attackers, with subscriber-level permissions or above to import new users and update existing users.

Key dates

02Disclosure timeline

July 18, 2023 CVE published
April 8, 2026 Record updated

Related vulnerabilities

04Related CVE

CVE-2023-49154 WordPress Button Generator – easily Button Builder plugin <= 2.3.8 - Broken Access Control vulnerability CVE-2024-49596 CVE-2023-47828 WordPress wpMandrill plugin <= 1.33 - Broken Access Control vulnerability CVE-2025-31774 WordPress plugin Astra Security Suite plugin<= 0.2 - Broken Access Control vulnerability CVE-2025-14342 SEO Plugin by Squirrly SEO <= 12.4.14 - Missing Authorization to Authenticated (Subscriber+) Cloud Service Disconnection