Technical impact
The ProfileGrid WordPress plugin, versions before 6.0.0.0, fails to enforce authorization when retrieving a group's pending membership requests. An authenticated user, such as a Subscriber, can access the pm_get_all_requests_from_group routine and obtain the names and request dates of users awaiting approval to join any group, including private ones. This allows the disclosure of potentially sensitive user information and compromises the confidentiality of group membership data, aligning with CWE-284 and CWE-862.
Affected Systems
Vendors: ProfileGrid, WordPress plugin. The issue affects all installations of ProfileGrid prior to version 6.0.0.0. No specific sub‑versions are listed, so the entire pre‑6.0.0.0 code base is vulnerable.
Risk and Exploitability
With a CVSS score of 4.3, the vulnerability presents a moderate confidentiality impact. The EPSS score of less than 1 percent suggests a low probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog. An authenticated user such as a Subscriber can exploit the missing authorization checks to view pending membership requests for any group, including private ones, and thus disclose user names and request dates. The need for only basic authentication and the lack of proper role checks make this a significant risk for sites relying on private groups.
