What the vulnerability does
01Description
The ProfileGrid – User Profiles, Groups and Communities plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the pm_decline_join_group_request and pm_approve_join_group_request functions in all versions up to, and including, 5.9.4.4. This makes it possible for authenticated attackers, with Subscriber-level access and above, to approve or decline join group requests which is normally should be available to administrators only.
Explanation of Vulnerability in Simple Terms
02Summary
ProfileGrid versions up to 5.9.4.4 lack proper authorization checks, allowing authenticated users to modify data they should not have access to. An attacker with a low-privilege account can alter information without the site owner's knowledge. No confidentiality breach occurs, but data integrity is at risk. Update to a version newer than 5.9.4.4.
What an attacker can do
03Attacker Capabilities
Modify data belonging to other users or restricted areas of the site.
Potential impact on your site
04Site Impact
User data and site content can be altered by low-privilege accounts, compromising data integrity.
Conditions required to exploit
05Prerequisites
Attacker must have a low-privilege account on the site; no user interaction required.
Key dates
06Disclosure timeline
March 22, 2025
CVE published
April 8, 2026
Record updated
