CVE-2024-37453: ProfileGrid Auth Bypass Vulnerability

CVE-2024-37453 Overview

CVE-2024-37453 is a missing authorization vulnerability in the ProfileGrid User Profiles, Groups and Communities plugin for WordPress. The flaw affects all versions of ProfileGrid up to and including 5.8.7. The plugin fails to enforce proper access control checks on protected functionality, allowing authenticated attackers with low privileges to perform actions reserved for higher-privileged users.

The issue is tracked under CWE-862: Missing Authorization. Successful exploitation compromises confidentiality, integrity, and availability of the affected WordPress site. The EPSS probability is 0.399% with a percentile of 33.04.

Critical Impact
Authenticated attackers can bypass authorization controls in ProfileGrid to access or modify data intended for privileged roles, leading to full compromise of plugin-managed content and user profiles.

Affected Products

Metagauss ProfileGrid User Profiles, Groups and Communities plugin for WordPress
All versions from n/a through 5.8.7
WordPress sites with the ProfileGrid plugin installed and activated

Discovery Timeline

2024-11-01 - CVE-2024-37453 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-37453

Vulnerability Analysis

The ProfileGrid plugin implements user profile, group, and community features on WordPress sites. Several plugin endpoints handle sensitive operations such as profile modification, group management, and administrative configuration. These endpoints lack proper capability checks that verify whether the requesting user is authorized to perform the requested action.

An authenticated user with low privileges, such as a subscriber-level account, can invoke these endpoints directly. The plugin processes the request without validating that the caller holds the required role or capability. This grants access to functionality that should be restricted to administrators or group managers.

The attack is executed over the network against exposed WordPress endpoints. Low attack complexity and no user interaction are required beyond authentication. Successful exploitation impacts confidentiality, integrity, and availability of plugin-managed data.

Root Cause

The root cause is the absence of authorization checks in one or more ProfileGrid request handlers. WordPress plugins are expected to call current_user_can() or verify nonces tied to capability checks before performing privileged actions. ProfileGrid handlers rely on authentication alone, treating any logged-in user as authorized. This maps to CWE-862 — Missing Authorization.

Attack Vector

Exploitation requires an authenticated session on the target WordPress site. Many ProfileGrid deployments permit open user registration, which lowers this barrier to a public attacker. The attacker sends crafted HTTP requests to vulnerable plugin endpoints, such as AJAX actions or REST routes exposed by ProfileGrid. Because no capability check runs, the server executes the privileged operation on behalf of the low-privilege caller. See the Patchstack Vulnerability Advisory for advisory details.

No public proof-of-concept code is currently available for this vulnerability.

Detection Methods for CVE-2024-37453

Indicators of Compromise

Unexpected modifications to WordPress user profiles, roles, or ProfileGrid group memberships not attributable to administrators.
HTTP POST requests to ProfileGrid AJAX handlers (admin-ajax.php with action=pm_* parameters) originating from low-privilege user sessions.
New administrative or elevated-permission entries in ProfileGrid group configurations that lack a corresponding admin audit trail.

Detection Strategies

Review WordPress access logs for repeated requests to ProfileGrid endpoints from subscriber-level accounts, particularly those targeting management or configuration actions.
Correlate WordPress database audit records for changes to wp_usermeta and ProfileGrid-specific tables against the acting user's role at the time of the change.
Deploy web application firewall (WAF) rules that flag ProfileGrid AJAX actions invoked by users whose role does not match the expected caller for that action.

Monitoring Recommendations

Enable verbose logging on wp-admin/admin-ajax.php and REST API routes registered by ProfileGrid.
Alert on privilege changes, group membership escalations, and profile field modifications performed outside of administrator sessions.
Track plugin version inventory across WordPress estates to identify hosts still running ProfileGrid 5.8.7 or earlier.

How to Mitigate CVE-2024-37453

Immediate Actions Required

Update ProfileGrid to the version released after 5.8.7 that includes the authorization fix referenced in the Patchstack advisory.
Audit all WordPress user accounts and remove unrecognized or dormant low-privilege accounts that could be used to reach vulnerable endpoints.
Review ProfileGrid group configurations, user roles, and profile data for unauthorized changes since the plugin was installed.

Patch Information

Metagauss addressed the missing authorization flaw in a ProfileGrid release subsequent to version 5.8.7. Administrators should install the latest version available in the WordPress plugin repository. The Patchstack advisory linked in the references section documents the fixed release. Sites unable to update immediately should treat ProfileGrid endpoints as untrusted.

Workarounds

Temporarily disable the ProfileGrid plugin until it can be updated to a patched version.
Restrict access to wp-admin/admin-ajax.php and ProfileGrid REST routes at the WAF layer for non-administrator sessions.
Disable open user registration (Settings > General > Anyone can register) to raise the barrier for authenticated exploitation.

bash

# Example: disable open registration and force plugin update via WP-CLI
wp option update users_can_register 0
wp plugin update profilegrid-user-profiles-groups-and-communities
wp plugin list --name=profilegrid-user-profiles-groups-and-communities --fields=name,status,version