CVE-2024-6411 Overview
CVE-2024-6411 is a privilege escalation vulnerability in the ProfileGrid – User Profiles, Groups and Communities plugin for WordPress. The flaw affects all versions up to and including 5.8.9. The vulnerability stems from missing validation on user-supplied data in the pm_upload_image AJAX action. Authenticated attackers with Subscriber-level access or above can update their own user capabilities to Administrator. Successful exploitation grants full control over the affected WordPress site. The issue is tracked under [CWE-269: Improper Privilege Management].
Critical Impact
A Subscriber-level account can escalate to Administrator, resulting in full site takeover including content modification, plugin installation, and access to all stored data.
Affected Products
- Metagauss ProfileGrid – User Profiles, Groups and Communities plugin for WordPress
- All versions up to and including 5.8.9
- WordPress sites with authenticated Subscriber-level users or above
Discovery Timeline
- 2024-07-10 - CVE-2024-6411 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-6411
Vulnerability Analysis
The ProfileGrid plugin exposes an AJAX action named pm_upload_image used to handle profile and cover image uploads. The handler accepts user-supplied parameters without validating which user fields the caller is permitted to modify. Because the handler ultimately writes to the WordPress usermeta and capability records, an authenticated attacker can inject the wp_capabilities meta key and assign themselves the administrator role. The vulnerability requires only Subscriber-level authentication, which is trivially obtained on any site with open registration.
Root Cause
The root cause is improper privilege management [CWE-269] within the pm_upload_image AJAX handler. The plugin fails to validate or allowlist the fields a caller may update through the request. It also does not enforce a capability check ensuring the calling user is authorized to modify role-related meta such as wp_capabilities. Client-side JavaScript in profile-magic-admin-power.js and the crop partials crop.php and coverimg_crop.php submit request parameters that the server-side handler trusts without sanitization.
Attack Vector
Exploitation is remote and network-accessible. An attacker registers a Subscriber account or uses an existing low-privileged account. The attacker then sends a crafted admin-ajax.php POST request invoking the pm_upload_image action with parameters that overwrite the user's own capabilities to include the Administrator role. After the request succeeds, the attacker logs in with full administrative privileges and can install malicious plugins, add PHP backdoors, or exfiltrate site data.
No verified proof-of-concept code is published in the referenced advisories. See the Wordfence Vulnerability Report and the ProfileGrid Plugin Changeset 3111609 for the patched code paths.
Detection Methods for CVE-2024-6411
Indicators of Compromise
- Unexpected users holding the administrator role, particularly accounts that were recently created as Subscribers.
- admin-ajax.php POST requests where the action parameter equals pm_upload_image and the body contains fields referencing wp_capabilities, role, or administrator.
- New plugin installations, theme edits, or PHP file uploads performed by newly elevated accounts.
- Unexpected entries in the wp_usermeta table modifying the wp_capabilities meta_key for non-admin users.
Detection Strategies
- Review WordPress audit logs and web server access logs for pm_upload_image AJAX calls originating from low-privileged sessions.
- Query the wp_usermeta table for users whose wp_capabilities value contains administrator and correlate against expected administrators.
- Alert on role changes performed outside of the /wp-admin/user-edit.php workflow.
Monitoring Recommendations
- Ingest WordPress access logs and application logs into a centralized SIEM and alert on pm_upload_image invocations combined with role-related parameter names.
- Monitor for creation of new administrator accounts, plugin/theme installs, and file writes under wp-content/ following suspicious AJAX activity.
- Track the plugin version deployed across managed WordPress instances and flag any site running ProfileGrid <= 5.8.9.
How to Mitigate CVE-2024-6411
Immediate Actions Required
- Update the ProfileGrid plugin to a version later than 5.8.9 that includes the fix from ProfileGrid Plugin Changeset 3111609.
- Audit all WordPress users and remove any unauthorized administrator accounts or role assignments.
- Rotate credentials and secrets for any account that held Administrator privileges during the exposure window.
- Disable open user registration or restrict default roles to Subscriber only until patching is confirmed.
Patch Information
The vendor addressed the vulnerability in the ProfileGrid plugin update tracked by ProfileGrid Plugin Changeset 3111609. The fix adds validation of user-supplied fields in the pm_upload_image handler so that capability and role-related meta cannot be modified through the image upload flow. Administrators should upgrade through the WordPress plugin manager and verify the installed version is greater than 5.8.9.
Workarounds
- Deactivate and remove the ProfileGrid plugin until the patched version is installed.
- Apply a web application firewall (WAF) rule that blocks admin-ajax.php requests where action=pm_upload_image includes parameters matching wp_capabilities, role, or administrator.
- Restrict admin-ajax.php access from untrusted networks where feasible and require multi-factor authentication for all WordPress accounts.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
