CVE-2024-31291: ProfileGrid Authorization Bypass Vulnerability

CVE-2024-31291 Overview

CVE-2024-31291 is an Insecure Direct Object Reference (IDOR) vulnerability in the Metagauss ProfileGrid WordPress plugin. The flaw affects the friend request feature in ProfileGrid versions up to and including 5.7.6. The plugin fails to validate that the authenticated user owns the object referenced by a user-controlled key, allowing horizontal access to other users' friend request data.

The vulnerability is classified under CWE-639: Authorization Bypass Through User-Controlled Key. An authenticated attacker with low privileges can manipulate request parameters to act on friend requests belonging to other ProfileGrid users.

Critical Impact
An authenticated attacker can access or manipulate friend request data belonging to other ProfileGrid users, breaching the integrity of the plugin's social features and exposing user relationship data.

Affected Products

Metagauss ProfileGrid WordPress plugin, versions up to and including 5.7.6
WordPress sites running the ProfileGrid: User Profiles, Groups and Communities plugin
Deployments exposing the ProfileGrid friend request functionality to authenticated users

Discovery Timeline

2024-04-07 - CVE-2024-31291 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-31291

Vulnerability Analysis

CVE-2024-31291 is an Insecure Direct Object Reference (IDOR) affecting ProfileGrid's friend request workflow. The plugin exposes friend request actions to authenticated users but does not confirm that the record identifier submitted in the request belongs to the calling user. As a result, an attacker who supplies a valid friend request identifier owned by another user can invoke actions on that record.

The consequence is a horizontal authorization bypass. Any logged-in ProfileGrid member can enumerate or guess numeric identifiers and interact with friend request records that they do not own. This breaks the trust boundary between distinct community members using the same site.

Root Cause

The root cause is missing ownership verification on a user-controlled key. The friend request handler trusts the identifier submitted by the client and performs the requested action without checking that the identifier maps to a record associated with the current session user. This is a canonical CWE-639 pattern.

Attack Vector

Exploitation requires an authenticated ProfileGrid account with standard privileges and network access to the WordPress site. No user interaction from the victim is required. The attacker submits a crafted friend request action containing an identifier belonging to a different user, and the plugin executes the action against that unrelated record.

No public proof-of-concept exploit code is available for CVE-2024-31291. For technical details, see the Patchstack Vulnerability Analysis.

Detection Methods for CVE-2024-31291

Indicators of Compromise

Unexpected changes to friend request state (accepted, declined, or removed relationships) reported by ProfileGrid users
Sequential or brute-forced numeric identifiers appearing in POST requests to ProfileGrid friend request endpoints
Access log entries showing a single authenticated user acting on many distinct friend request identifiers in a short interval

Detection Strategies

Review WordPress access logs for admin-ajax.php and ProfileGrid REST endpoints where the same authenticated session references friend request IDs across a wide range of users
Correlate ProfileGrid database changes to the acting user session and alert when the acting user is not the owner or recipient of the friend request record
Enable and audit ProfileGrid activity logs, if available, to identify unauthorized modifications to friend relationships

Monitoring Recommendations

Monitor the installed ProfileGrid version against 5.7.6 and flag any site still running an unpatched release
Track anomalous request rates to ProfileGrid friend request actions from individual authenticated accounts
Alert on new low-privilege accounts that rapidly interact with friend request functionality shortly after registration

How to Mitigate CVE-2024-31291

Immediate Actions Required

Update the Metagauss ProfileGrid plugin to a version later than 5.7.6 that includes the vendor fix referenced in the Patchstack advisory
Audit ProfileGrid friend request records for unexpected modifications made prior to patching
Review recently registered ProfileGrid user accounts and revoke any that exhibit abusive behavior

Patch Information

Metagauss has released a fixed version of ProfileGrid that addresses the IDOR on the friend request feature. Site administrators should upgrade the plugin from any version up to and including 5.7.6 to the latest available release through the WordPress plugin manager. Consult the Patchstack Vulnerability Analysis for the specific patched version.

Workarounds

Restrict access to ProfileGrid community features until the plugin is updated, for example by limiting registration or disabling the friend request feature in plugin settings
Deploy a web application firewall rule that inspects requests to ProfileGrid friend request endpoints and blocks requests where the referenced identifier does not correlate with the authenticated session
Reduce the ProfileGrid attack surface by removing unused ProfileGrid modules and requiring administrator approval for new registrations

bash

# Example: update the ProfileGrid plugin using WP-CLI
wp plugin update profilegrid-user-profiles-groups-and-communities
wp plugin get profilegrid-user-profiles-groups-and-communities --field=version