Unauthorized Decryption Vulnerability in ProfileGrid Plugin for WordPress

CVE-2023-3404

Summary

The ProfileGrid plugin for WordPress presents a serious vulnerability due to hardcoded passphrase and initialization vector (iv) in its 'pm_encrypt_decrypt_pass' function. This flaw affects all sites utilizing the plugin versions up to and including 5.5.0, enabling authenticated attackers with administrator-level access to decrypt and potentially expose users' passwords. If exploited in conjunction with additional vulnerabilities, this could allow users with lower privileges to gain access to sensitive information, raising significant cybersecurity concerns.

References