CVE-2024-32772 Overview
CVE-2024-32772 is an Insecure Direct Object Reference (IDOR) vulnerability in the Metagauss ProfileGrid plugin for WordPress. The flaw affects all versions up to and including 5.7.9. Authenticated attackers with low privileges can manipulate user-controlled key parameters to access or modify resources belonging to other users.
The vulnerability is tracked under CWE-639: Authorization Bypass Through User-Controlled Key. ProfileGrid provides user profile, group, and community features to WordPress sites, so successful exploitation can expose personal data across a site's entire membership base.
Critical Impact
An authenticated attacker can bypass authorization checks over the network to read, modify, or delete data belonging to other ProfileGrid users, resulting in confidentiality, integrity, and availability loss.
Affected Products
- Metagauss ProfileGrid plugin for WordPress
- All versions from initial release through 5.7.9
- WordPress sites using ProfileGrid: User Profiles, Groups and Communities
Discovery Timeline
- 2024-04-24 - CVE-2024-32772 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-32772
Vulnerability Analysis
The vulnerability stems from missing authorization checks on object identifiers that ProfileGrid accepts from client requests. The plugin trusts user-controlled keys, such as profile or group identifiers, when performing sensitive operations. It does not validate that the requesting user owns or has permission to act on the referenced object.
An authenticated user with a standard ProfileGrid account can send requests that reference another user's identifier. The plugin processes those requests and returns or modifies data belonging to the target account. The attack requires no elevated permissions and no user interaction from the victim.
The scope of impact covers the confidentiality, integrity, and availability of ProfileGrid records. Attackers can enumerate profiles, alter group memberships, or delete records assigned to other users.
Root Cause
ProfileGrid relies on client-supplied identifiers to locate records but omits ownership validation before executing database operations. This is a classic [CWE-639] pattern where authentication is enforced but authorization is not tied to the requested resource.
Attack Vector
Exploitation occurs over the network against the WordPress site. An attacker registers or uses an existing low-privileged account, then issues crafted HTTP requests to ProfileGrid endpoints while substituting another user's numeric identifier. The Patchstack Vulnerability Report documents the specific parameters affected.
Detection Methods for CVE-2024-32772
Indicators of Compromise
- Unexpected changes to user profile fields, avatars, or group memberships that users did not initiate.
- Repeated authenticated requests to ProfileGrid AJAX or REST endpoints that increment or iterate user or group identifier parameters.
- Access log entries showing a single authenticated session referencing many distinct user IDs in ProfileGrid actions.
Detection Strategies
- Inspect WordPress access logs for sequential enumeration of user_id, group_id, or similar parameters against ProfileGrid endpoints.
- Correlate the acting session's user ID with the target object ID in requests, and flag mismatches where privilege does not permit cross-user actions.
- Review the WordPress wp_usermeta and ProfileGrid tables for modifications outside expected user-initiated flows.
Monitoring Recommendations
- Enable verbose HTTP request logging on the WordPress front-end proxy or web application firewall (WAF).
- Alert on high-rate ProfileGrid requests from a single authenticated user against varied object identifiers.
- Retain plugin-specific audit trails so administrators can reconstruct which account performed each profile or group modification.
How to Mitigate CVE-2024-32772
Immediate Actions Required
- Update the Metagauss ProfileGrid plugin to a version later than 5.7.9 as soon as the vendor-supplied patched release is available.
- Audit ProfileGrid user accounts and group memberships for unauthorized modifications made prior to patching.
- Restrict new user registration on affected sites until the plugin is updated, reducing the pool of accounts that could exploit the flaw.
Patch Information
Refer to the Patchstack Vulnerability Report for the fixed release information. Upgrade from any version through 5.7.9 to the vendor-designated fixed version, then verify the plugin version in the WordPress admin dashboard under Plugins.
Workarounds
- Deactivate the ProfileGrid plugin until an upgrade can be applied if the site is not actively using its community features.
- Deploy WAF rules that inspect ProfileGrid endpoint parameters and block requests where the referenced user or group identifier does not match the authenticated session.
- Reduce exposure by disabling open registration or requiring administrator approval for new accounts on ProfileGrid-enabled sites.
# Verify the installed ProfileGrid version using WP-CLI
wp plugin get profilegrid-user-profiles-groups-and-communities --field=version
# Update ProfileGrid to the latest available release
wp plugin update profilegrid-user-profiles-groups-and-communities
# If a patched release is not yet installed, deactivate as a temporary control
wp plugin deactivate profilegrid-user-profiles-groups-and-communities
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
