Potential Privilege Escalation Vulnerability in ProfileGrid User Profiles, Groups and Communities Plugin
CVE-2024-6411

8.8HIGH

Key Information:

Vendor

Wordpress
Status
Profilegrid
Vendor
CVE Published:
10 July 2024

What is CVE-2024-6411?

The ProfileGrid – User Profiles, Groups and Communities plugin for WordPress has a vulnerability associated with privilege escalation that impacts all versions up to and including 5.8.9. This flaw arises from a lack of proper validation on user-supplied data within the 'pm_upload_image' AJAX action. Consequently, authenticated attackers with Subscriber-level access or higher may exploit this weakness to elevate their user capabilities to that of an Administrator, compromising the integrity and security of WordPress installations utilizing this plugin.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://plugins.trac.wordpress.org/browser/profilegrid-us...
https://plugins.trac.wordpress.org/browser/profilegrid-us...

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

JSON
.