CVE-2024-32774 Overview
CVE-2024-32774 is an Improper Restriction of Excessive Authentication Attempts vulnerability [CWE-307] in the Metagauss ProfileGrid WordPress plugin. The flaw affects all versions of ProfileGrid up to and including 5.8.2. Authenticated attackers with low privileges can bypass the group members limit control, removing important client-side functionality intended to restrict group participation.
The issue is exploitable over the network with low attack complexity and requires only low-privileged authentication. Successful exploitation impacts confidentiality, integrity, and availability of the affected WordPress site.
Critical Impact
Authenticated attackers can bypass authentication attempt restrictions in ProfileGrid, defeating client-side controls and enabling unauthorized modifications to group membership functionality.
Affected Products
- Metagauss ProfileGrid WordPress plugin, all versions through 5.8.2
- WordPress installations using ProfileGrid for user profiles, groups, and communities
- Sites relying on ProfileGrid group member limit controls
Discovery Timeline
- 2024-05-17 - CVE-2024-32774 published to the National Vulnerability Database (NVD)
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-32774
Vulnerability Analysis
The vulnerability originates from improper restriction of excessive authentication attempts within the ProfileGrid plugin. ProfileGrid enforces certain functionality, including group member limits, through controls that can be bypassed by an authenticated user. The plugin fails to properly rate-limit or validate repeated attempts against protected functionality on the server side.
Because the group members limit is enforced through logic that a client can circumvent, an attacker with a valid low-privileged WordPress account can repeatedly submit requests to remove or exceed the client-side restrictions. This weakens the plugin's ability to enforce group size, membership rules, and related controls.
The vulnerability is classified under CWE-307 — Improper Restriction of Excessive Authentication Attempts. Consult the Patchstack Vulnerability Advisory for full technical context.
Root Cause
The root cause is missing server-side enforcement and missing throttling of authenticated requests against group membership functionality. ProfileGrid trusts client-side controls to restrict actions such as adding members to a group. Attackers who bypass those controls face no counter-mechanism such as request throttling, lockout, or server-side quota validation.
Attack Vector
An authenticated attacker submits crafted HTTP requests to the ProfileGrid endpoints handling group membership. By replaying the request or omitting client-side parameters that trigger limit checks, the attacker adds members beyond the configured group members limit. No user interaction is required, and the attack is remotely exploitable against any WordPress site running a vulnerable ProfileGrid release.
No public proof-of-concept exploit and no CISA KEV listing are associated with CVE-2024-32774 at time of writing. Refer to the Patchstack advisory for reproduction details.
Detection Methods for CVE-2024-32774
Indicators of Compromise
- Group membership counts in ProfileGrid that exceed the configured maximum group members value.
- Repeated POST requests from authenticated sessions targeting ProfileGrid group join or member management endpoints within short time windows.
- Sudden growth in wp_pm_group_users (or equivalent ProfileGrid tables) without corresponding administrative actions in WordPress audit logs.
Detection Strategies
- Enable WordPress activity logging to record authenticated actions against ProfileGrid endpoints, including HTTP method, user ID, and target group.
- Compare recorded group membership counts against configured ProfileGrid limits on a scheduled basis and alert on mismatches.
- Inspect web server access logs for repeated requests to ProfileGrid AJAX handlers by the same authenticated user within brief intervals.
Monitoring Recommendations
- Forward WordPress and web server logs to a centralized logging platform for correlation with authentication events.
- Monitor plugin version inventory across WordPress deployments to identify hosts still running ProfileGrid 5.8.2 or earlier.
- Alert on new low-privileged account registrations followed by rapid activity against ProfileGrid group endpoints.
How to Mitigate CVE-2024-32774
Immediate Actions Required
- Update Metagauss ProfileGrid to a version later than 5.8.2 as provided by the vendor.
- Audit existing ProfileGrid groups for membership counts that exceed configured limits and reconcile them.
- Review WordPress user accounts for unexpected registrations and disable inactive or suspicious low-privileged accounts.
Patch Information
Metagauss addresses the group members limit bypass in ProfileGrid releases published after 5.8.2. Refer to the Patchstack Vulnerability Advisory for the fixed version reference and update through the WordPress plugin management interface.
Workarounds
- Deploy a Web Application Firewall (WAF) rule to rate-limit authenticated requests to ProfileGrid group endpoints.
- Restrict user registration on affected WordPress sites until the plugin is updated.
- Temporarily disable the ProfileGrid plugin on high-risk sites where a patched version cannot be applied immediately.
# Configuration example: WordPress CLI update for ProfileGrid
wp plugin update profilegrid-user-profiles-groups-and-communities
wp plugin get profilegrid-user-profiles-groups-and-communities --field=version
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
