CVE-2023-3713 HIGH

CVE-2023-3713: ProfileGrid <= 5.5.1 - Authenticated (Subscriber+) Arbitrary Option Update

Vendor Metagauss
Product ProfileGrid – User Profiles, Groups and Communities
Weakness CWE-862 · Missing authorization
Published July 18, 2023
Last update April 8, 2026
View on NVD All CVEs

CVSS base score

8.8/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality High
Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

What the vulnerability does

01Description

The ProfileGrid plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'profile_magic_check_smtp_connection' function in versions up to, and including, 5.5.1. This makes it possible for authenticated attackers, with subscriber-level permissions or above to update the site options arbitrarily. This can be used by attackers to achieve privilege escalation.

Key dates

02Disclosure timeline

July 18, 2023 CVE published
April 8, 2026 Record updated