Unauthorized Data Modification in ProfileGrid Plugin for WordPress

CVE-2025-1408

What is CVE-2025-1408?

The ProfileGrid – User Profiles, Groups and Communities plugin for WordPress is susceptible to unauthorized data modification due to insufficient checks on the pm_decline_join_group_request and pm_approve_join_group_request functions. This flaw permits authenticated users with Subscriber-level access and above to manipulate group join requests, which should be restricted to administrators. As a result, attackers can potentially compromise group management capabilities, posing a risk to data integrity and user trust.

References