Unauthorized Decryption Vulnerability in ProfileGrid Plugin for WordPress
CVE-2023-3404
4.9MEDIUM
Key Information:
- Vendor
WordPress
- Vendor
- CVE Published:
- 31 August 2023
What is CVE-2023-3404?
The ProfileGrid plugin for WordPress presents a serious vulnerability due to hardcoded passphrase and initialization vector (iv) in its 'pm_encrypt_decrypt_pass' function. This flaw affects all sites utilizing the plugin versions up to and including 5.5.0, enabling authenticated attackers with administrator-level access to decrypt and potentially expose users' passwords. If exploited in conjunction with additional vulnerabilities, this could allow users with lower privileges to gain access to sensitive information, raising significant cybersecurity concerns.
Affected Version(s)
ProfileGrid – User Profiles, Memberships, Groups and Communities * <= 5.5.0