Description
The ProfileGrid – User Profiles, Groups and Communities plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.8.9 via the 'pm_upload_image' function due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with Subscriber-level access and above, to change the profile picture of any user.
Analysis
No analysis available yet.
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||
|---|---|---|---|---|---|---|---|---|---|
| metagauss | ProfileGrid – User Profiles, Groups and Communities | unaffected |
|
No data.
No data available yet.
Remediation
No remediation available yet.
Tracking
Sign in to view the affected projects.
Advisories
| Source | ID | Title |
|---|---|---|
 EUVD |
EUVD-2024-47514 | The ProfileGrid – User Profiles, Groups and Communities plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.8.9 via the 'pm_upload_image' function due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with Subscriber-level access and above, to change the profile picture of any user. |
References
History
Mon, 10 Feb 2025 16:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| First Time appeared |
Metagauss
Metagauss profilegrid |
|
| Weaknesses | CWE-639 | |
| CPEs | cpe:2.3:a:metagauss:profilegrid:*:*:*:*:*:wordpress:*:* | |
| Vendors & Products |
Metagauss
Metagauss profilegrid |
MITRE
Status: PUBLISHED
Assigner: Wordfence
Published:
Updated: 2024-08-01T21:41:03.305Z
Reserved: 2024-06-28T19:07:34.924Z
Link: CVE-2024-6410
Vulnrichment
Updated: 2024-08-01T21:41:03.305Z
NVD
Status : Analyzed
Published: 2024-07-10T05:15:12.313
Modified: 2025-02-10T16:02:35.810
Link: CVE-2024-6410
Redhat
No data.
OpenCVE Enrichment
No data.
Weaknesses