The vulnerability is a missing capability check in the pm_decline_join_group_request and pm_approve_join_group_request functions. As a result, users who possess only Subscriber-level access—or any role equal to or higher than Subscriber—can illegitimately approve or decline requests to join a group. This allows an authenticated attacker to alter group membership, bypassing administrative controls and potentially granting themselves or others membership to groups they should not belong to, thereby affecting community integrity and privacy.

The affected product is the ProfileGrid – User Profiles, Groups and Communities WordPress plugin, version 5.9.4.4 and earlier. The plugin is distributed by Metagauss and is installed on WordPress sites where group and community functionality is enabled.

The CVSS score of 4.3 indicates moderate severity, while the EPSS score of less than 1% suggests a low probability of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog, implying no publicly known active exploitation. Because the flaw requires an authenticated user, the attack vector is limited to authenticated access (Subscriber or above) and does not necessitate remote code execution or network-level attacks.