CVE-2024-31362: Metagauss ProfileGrid CSRF Vulnerability

CVE-2024-31362 Overview

CVE-2024-31362 is a Cross-Site Request Forgery (CSRF) vulnerability affecting the Metagauss ProfileGrid plugin for WordPress. The flaw impacts all versions from initial release through 5.7.8. Attackers can leverage forged authenticated requests to perform unauthorized actions within the plugin context. The issue is tracked under CWE-352 and was published to the National Vulnerability Database on April 12, 2024.

Exploitation requires user interaction, typically by tricking an authenticated administrator into visiting an attacker-controlled page. Successful exploitation can compromise confidentiality, integrity, and availability of the affected WordPress site.

Critical Impact

A successful CSRF attack against an administrator can lead to full compromise of the ProfileGrid plugin configuration and associated user profile, group, and community data on the WordPress site.

Affected Products

• Metagauss ProfileGrid plugin for WordPress
• All versions from n/a through 5.7.8
• WordPress sites using the ProfileGrid user profiles, memberships, groups, and communities plugin

Discovery Timeline

• 2024-04-12 - CVE-2024-31362 published to NVD
• 2026-04-28 - Last updated in NVD database

Technical Details for CVE-2024-31362

Vulnerability Analysis

The vulnerability is a Cross-Site Request Forgery (CSRF) weakness classified under [CWE-352]. ProfileGrid fails to adequately validate the origin or authenticity of state-changing HTTP requests submitted to plugin endpoints. An attacker can craft a malicious web page or email that triggers a request to a vulnerable ProfileGrid action when visited by a logged-in user.

Because the WordPress session cookie is automatically sent with the forged request, the action executes with the victim's privileges. When the victim is an administrator, the attacker effectively gains administrative control over ProfileGrid functionality. This includes profile data, group memberships, and community configuration managed by the plugin.

The attack does not require credentials or prior access to the target site. It does require the victim to interact with attacker-controlled content while authenticated to the WordPress instance.

Root Cause

The root cause is the absence or improper validation of anti-CSRF tokens (WordPress nonces) on sensitive plugin actions. WordPress provides wp_nonce_field() and check_admin_referer() primitives to prevent this class of issue. ProfileGrid versions up to 5.7.8 do not enforce these checks consistently across all privileged operations.

Attack Vector

The attack vector is network-based and requires user interaction. An attacker hosts a malicious page containing a hidden form or image tag that issues a request to a vulnerable ProfileGrid endpoint on the target WordPress site. When an authenticated administrator visits the page, the browser submits the forged request along with valid session cookies, and the plugin processes it as legitimate.

For technical details, see the Patchstack Vulnerability Advisory.

Detection Methods for CVE-2024-31362

Indicators of Compromise

• Unexpected changes to ProfileGrid plugin settings, user groups, or community configurations not initiated by administrators
• HTTP POST requests to ProfileGrid endpoints with Referer headers pointing to external, untrusted domains
• WordPress audit log entries showing administrative actions performed shortly after an admin browsed external links

Detection Strategies

• Inspect web server access logs for requests to ProfileGrid admin endpoints lacking valid nonce parameters
• Monitor for anomalous administrative actions correlated with cross-origin Referer headers
• Deploy a Web Application Firewall (WAF) ruleset that flags state-changing requests to WordPress plugins missing CSRF tokens

Monitoring Recommendations

• Enable a WordPress activity logging plugin to capture administrator actions and their source
• Correlate plugin configuration changes with administrator browsing activity using SIEM telemetry
• Alert on ProfileGrid configuration modifications outside of approved change windows

How to Mitigate CVE-2024-31362

Immediate Actions Required

• Update Metagauss ProfileGrid to a version later than 5.7.8 that addresses the CSRF flaw
• Audit recent ProfileGrid configuration changes and user group modifications for unauthorized activity
• Instruct administrators to log out of WordPress sessions when not actively administering the site

Patch Information

Metagauss has released a fixed version of ProfileGrid addressing this CSRF issue. Refer to the Patchstack Vulnerability Advisory for the patched release information and download details.

Workarounds

• Deploy a WAF rule that blocks requests to ProfileGrid endpoints missing valid WordPress nonce parameters
• Restrict administrative access to the WordPress dashboard by IP allowlisting where feasible
• Require administrators to use a dedicated browser profile or session for WordPress administration to reduce cross-site request exposure
• Temporarily disable the ProfileGrid plugin if patching cannot be performed immediately