Limited Server-Side Request Forgery Vulnerability in ProfileGrid for WordPress

CVE-2024-13741

What is CVE-2024-13741?

The ProfileGrid – User Profiles, Groups and Communities plugin for WordPress contains a vulnerability that allows authenticated users with Subscriber access or higher to exploit the pm_upload_image function. This flaw enables these users to generate server-side requests to arbitrary destinations, which can be manipulated to download and inspect images, or verify the presence of non-image files on both local and remote servers. This poses significant risks to web application integrity and user data security.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References