The ProfileGrid – User Profiles, Groups and Communities plugin for WordPress has a missing capability check on the pm_deactivate_user_from_group function. This flaw lets any authenticated user with Subscriber-level access or higher call a public AJAX action that suspends arbitrary users from groups, including administrators, without permission. The absence of a capability check allows an attacker to target arbitrary accounts and enforce unwanted suspensions, effectively denying legitimate access and disrupting community interactions. The weakness is a classic missing authorization flaw, classified as CWE-862.

All releases of the ProfileGrid – User Profiles, Groups and Communities plugin ranging from the earliest versions through 5.9.7.2, developed by Metagauss.

The CVSS score of 4.3 denotes a low severity impact, and the EPSS score of less than 1% indicates a very low chance of exploitation. The vulnerability is not listed in the CISA KEV catalog. Attackers only need valid WordPress credentials at the Subscriber level, so the attack vector is internal authentication. The lack of a capability check permits the exploit to be carried out remotely via the AJAX endpoint, making it straightforward for an authenticated attacker to suspend users.