CVE-2023-0940
📋 TL;DR
The ProfileGrid WordPress plugin before version 5.3.1 contains an authorization bypass vulnerability in its password reset functionality. This allows any authenticated user, even with low privileges like 'subscriber', to reset passwords for any account including administrators. All WordPress sites using vulnerable versions of this plugin are affected.
💻 Affected Systems
- ProfileGrid WordPress Plugin
📦 What is this software?
Profilegrid by Metagauss
⚠️ Risk & Real-World Impact
Worst Case
An attacker gains full administrative control over the WordPress site, potentially leading to complete site compromise, data theft, malware injection, or site defacement.
Likely Case
Attackers reset administrator passwords to gain privileged access, then install backdoors, steal sensitive data, or modify site content.
If Mitigated
With proper access controls and monitoring, unauthorized password resets would be detected and blocked before significant damage occurs.
🎯 Exploit Status
Exploitation requires authenticated access but only subscriber-level privileges. The vulnerability is well-documented and simple to exploit.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 5.3.1
Vendor Advisory: https://wpscan.com/vulnerability/56744f72-2d48-4f42-8195-24b4dd951bb5
Restart Required: No
Instructions:
1. Log into WordPress admin panel. 2. Navigate to Plugins → Installed Plugins. 3. Find ProfileGrid plugin. 4. Click 'Update Now' if available, or download version 5.3.1+ from WordPress repository. 5. Activate the updated plugin.
🔧 Temporary Workarounds
Disable ProfileGrid Plugin
allTemporarily deactivate the vulnerable plugin until patching is possible
wp plugin deactivate profilegrid
Restrict User Registration
allDisable new user registration to prevent attackers from obtaining subscriber accounts
wp option update users_can_register 0
🧯 If You Can't Patch
- Implement web application firewall rules to block requests to the vulnerable AJAX endpoint
- Enable detailed logging for user password reset attempts and monitor for suspicious activity
🔍 How to Verify
Check if Vulnerable:
Check WordPress admin panel → Plugins → ProfileGrid version numberCheck Version:
wp plugin get profilegrid --field=versionVerify Fix Applied:
Confirm ProfileGrid plugin version is 5.3.1 or higher📡 Detection & Monitoring
Log Indicators:
- Multiple password reset attempts from low-privilege users
- AJAX requests to profilegrid password reset endpoints from non-admin users
Network Indicators:
- POST requests to /wp-admin/admin-ajax.php with action=profilegrid_reset_password
SIEM Query:
source="wordpress.log" AND "admin-ajax.php" AND "profilegrid_reset_password"