Unauthorized Data Modification in ProfileGrid Plugin for WordPress
CVE-2023-3713
8.8HIGH
Key Information:
- Vendor
WordPress
- Vendor
- CVE Published:
- 18 July 2023
What is CVE-2023-3713?
The ProfileGrid plugin for WordPress has a significant flaw that allows authenticated users with minimum subscriber-level permissions to exploit a missing capability check in the 'profile_magic_check_smtp_connection' function. This vulnerability can be leveraged to update site options without proper authorization, potentially leading to privilege escalation and unauthorized changes within the site configuration.
Affected Version(s)
ProfileGrid – User Profiles, Memberships, Groups and Communities * <= 5.5.1