CVE-2025-1408
📋 TL;DR
This vulnerability allows authenticated WordPress users with Subscriber-level access or higher to approve or decline group join requests, which should be restricted to administrators only. It affects all versions of the ProfileGrid plugin up to 5.9.4.4. Attackers can manipulate group membership without proper authorization.
💻 Affected Systems
- ProfileGrid – User Profiles, Groups and Communities WordPress plugin
📦 What is this software?
Profilegrid by Metagauss
⚠️ Risk & Real-World Impact
Worst Case
Attackers could approve malicious users into sensitive groups, decline legitimate join requests to disrupt community operations, or manipulate group composition for social engineering attacks.
Likely Case
Low-privileged users gain unauthorized control over group membership decisions, potentially allowing them to join restricted groups or disrupt community management.
If Mitigated
With proper access controls and monitoring, impact is limited to minor group management disruptions that can be quickly detected and reversed.
🎯 Exploit Status
Exploitation requires authenticated access but is straightforward once authenticated. The missing capability check makes exploitation simple.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 5.9.4.5 or later
Restart Required: No
Instructions:
1. Log into WordPress admin panel. 2. Navigate to Plugins → Installed Plugins. 3. Find ProfileGrid plugin. 4. Click 'Update Now' if available. 5. Alternatively, download version 5.9.4.5+ from WordPress repository and manually update.
🔧 Temporary Workarounds
Temporary Plugin Deactivation
allDisable the ProfileGrid plugin until patched
wp plugin deactivate profilegrid-user-profiles-groups-and-communities
Role-Based Access Restriction
allTemporarily restrict Subscriber role capabilities using a security plugin
🧯 If You Can't Patch
- Implement strict monitoring of group membership changes and user activity logs
- Temporarily disable group join/approval features or restrict to trusted administrators only
🔍 How to Verify
Check if Vulnerable:
Check ProfileGrid plugin version in WordPress admin under Plugins → Installed Plugins. If version is 5.9.4.4 or lower, you are vulnerable.Check Version:
wp plugin get profilegrid-user-profiles-groups-and-communities --field=versionVerify Fix Applied:
Verify plugin version is 5.9.4.5 or higher. Test that Subscriber-level users cannot approve/decline group join requests.📡 Detection & Monitoring
Log Indicators:
- Unexpected group membership changes by non-admin users
- pm_approve_join_group_request or pm_decline_join_group_request calls from low-privilege accounts
Network Indicators:
- POST requests to WordPress admin-ajax.php with pm_approve_join_group_request or pm_decline_join_group_request actions from non-admin users
SIEM Query:
source="wordpress.log" AND (action="pm_approve_join_group_request" OR action="pm_decline_join_group_request") AND user_role!="administrator"🔗 References
- https://plugins.trac.wordpress.org/browser/profilegrid-user-profiles-groups-and-communities/tags/5.9.4.3/public/class-profile-magic-public.php#L3262
- https://plugins.trac.wordpress.org/browser/profilegrid-user-profiles-groups-and-communities/tags/5.9.4.3/public/class-profile-magic-public.php#L3306
- https://www.wordfence.com/threat-intel/vulnerabilities/id/641f7727-83ba-45c2-b3e1-1ce19f86eac7?source=cve
