The ProfileGrid – User Profiles, Groups and Communities WordPress plugin is affected by insecure direct object reference, recognized as CWE‑639. Because the update_user_meta() function is called outside of the WordPress authorization check in public/partials/crop.php and public/partials/coverimg_crop.php, an authenticated user with Subscriber-level access or higher can directly target the pm_upload_image and pm_upload_cover_image AJAX actions to change any user's profile picture or cover image, even of administrators.

The Vulnerable component is the ProfileGrid plugin distributed by metagauss. All releases up to and including 5.9.7.2 include the flaw; releases beyond 5.9.7.2 contain the fix.

With a CVSS score of 5.3 the issue is classified as medium severity. The EPSS score falls below 1%, indicating a low likelihood of exploitation, and the vulnerability is not listed in the CISA KEV catalog. Attackers must be authenticated and must craft appropriate AJAX requests to the pm_upload_image or pm_upload_cover_image endpoints. Although the attack vector requires valid credentials, the flaw permits unauthorized modification of user-identifying imagery, potentially impacting trust and accountability on the site, but does not grant remote code execution or compromise broader system integrity.