CVE-2024-10900 Overview
CVE-2024-10900 is a missing authorization vulnerability in the ProfileGrid – User Profiles, Groups and Communities plugin for WordPress. The flaw resides in the pm_remove_file_attachment() function, which lacks a capability check before processing requests. All plugin versions up to and including 5.9.3.6 are affected.
Authenticated attackers holding subscriber-level access or above can delete arbitrary user meta records. Deleting critical user meta entries can revoke an administrator's access to their own site, resulting in loss of site control. The vulnerability is classified under CWE-862: Missing Authorization.
Critical Impact
Any authenticated subscriber can delete arbitrary WordPress user meta records, potentially locking administrators out of their own sites.
Affected Products
- Metagauss ProfileGrid – User Profiles, Groups and Communities plugin for WordPress
- All versions up to and including 5.9.3.6
- WordPress sites permitting subscriber-level registration with ProfileGrid installed
Discovery Timeline
- 2024-11-20 - CVE-2024-10900 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-10900
Vulnerability Analysis
The ProfileGrid plugin exposes the pm_remove_file_attachment() function through a WordPress AJAX endpoint. The function is responsible for removing file attachments associated with user profiles and their related user meta entries. The plugin registers this handler for authenticated users but omits a current_user_can() capability check inside the function body.
Because the endpoint accepts user-supplied identifiers referencing the meta record to remove, an attacker can target arbitrary user meta keys tied to any user, including administrators. Deleting entries such as wp_capabilities for an administrator removes their role assignments, leaving them without administrative privileges the next time they load the site.
See the WordPress Plugin Code Review for the vulnerable function definition and the Wordfence Vulnerability Report for additional analysis.
Root Cause
The root cause is a missing authorization check inside pm_remove_file_attachment(). The handler validates that a request is authenticated but does not verify that the caller has the right to modify the targeted user's meta. Any user with an account, including the default subscriber role, satisfies the authentication requirement.
Attack Vector
Exploitation requires network access to the WordPress site and a valid low-privileged account. The attacker sends an authenticated AJAX request to the vulnerable endpoint, supplying parameters that reference the user meta record to delete. No user interaction from a victim is required, and the request completes successfully because the capability check is absent.
The vulnerability is described in prose only. No public proof-of-concept exploit is available in ExploitDB or vendor advisories at the time of publication.
Detection Methods for CVE-2024-10900
Indicators of Compromise
- Unexpected AJAX requests targeting ProfileGrid actions associated with removing attachments in web server access logs
- Administrator accounts suddenly losing role assignments or being unable to access wp-admin
- Missing or altered wp_capabilities, wp_user_level, or related user meta rows in the wp_usermeta table
- Subscriber-level accounts generating repeated POST requests to admin-ajax.php with ProfileGrid action parameters
Detection Strategies
- Audit wp_usermeta for unexpected deletions, particularly for administrator user IDs, and compare against database backups
- Review web server and WordPress request logs for authenticated admin-ajax.php calls invoking ProfileGrid file attachment removal handlers
- Enumerate installed plugin versions across managed WordPress sites and flag ProfileGrid installations at version 5.9.3.6 or earlier
Monitoring Recommendations
- Alert on any WordPress user losing the administrator role outside of scheduled change windows
- Monitor for spikes in subscriber-authored requests to plugin AJAX endpoints, which typically indicate abuse of low-privileged accounts
- Forward WordPress audit and web server logs to a central analytics platform so plugin-specific abuse patterns can be correlated across sites
How to Mitigate CVE-2024-10900
Immediate Actions Required
- Update the ProfileGrid – User Profiles, Groups and Communities plugin to a version later than 5.9.3.6 on all WordPress sites
- Disable open user registration or restrict the default new-user role if the plugin cannot be updated immediately
- Review administrator accounts and restore any user meta entries removed as a result of exploitation from a known-good backup
Patch Information
Metagauss addressed the missing capability check in a subsequent release. Refer to the WordPress Plugin Change Log for the changeset that introduces the fix. Site owners should apply the patched version through the WordPress plugin updater or by replacing the plugin files directly.
Workarounds
- Deactivate the ProfileGrid plugin until the patched version has been deployed if immediate updates are not possible
- Block requests to the vulnerable AJAX action at the web application firewall or reverse proxy, filtering on the ProfileGrid action parameter
- Temporarily disable new user registration in WordPress settings to prevent unauthenticated actors from provisioning subscriber accounts for exploitation
# Example: disable ProfileGrid via WP-CLI until a patched version is deployed
wp plugin deactivate profilegrid-user-profiles-groups-and-communities
# After updating, confirm the installed version is greater than 5.9.3.6
wp plugin get profilegrid-user-profiles-groups-and-communities --field=version
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
