CVE-2025-13416: ProfileGrid Plugin Auth Bypass Flaw

CVE-2025-13416 Overview

The ProfileGrid – User Profiles, Groups and Communities plugin for WordPress contains a missing authorization vulnerability in the pm_deactivate_user_from_group() function. This security flaw affects all versions up to and including 5.9.7.2, allowing authenticated attackers with minimal privileges (Subscriber-level access and above) to suspend arbitrary users from groups without proper capability verification.

Critical Impact

Authenticated attackers with low-privilege accounts can suspend any user from groups, including administrators, potentially disrupting site operations and user management through the pm_deactivate_user_from_group AJAX action.

Affected Products

• ProfileGrid – User Profiles, Groups and Communities plugin for WordPress versions ≤ 5.9.7.2
• WordPress installations utilizing the ProfileGrid plugin with group functionality enabled
• Sites allowing user registration with subscriber-level access

Discovery Timeline

• February 5, 2026 - CVE-2025-13416 published to NVD
• February 5, 2026 - Last updated in NVD database

Technical Details for CVE-2025-13416

Vulnerability Analysis

This vulnerability represents a classic Missing Authorization flaw (CWE-862) in the WordPress plugin ecosystem. The pm_deactivate_user_from_group() function processes user suspension requests via an AJAX endpoint without implementing proper capability checks. When a request is made to the pm_deactivate_user_from_group action, the function fails to verify whether the requesting user has the appropriate permissions to perform administrative actions on other users.

The attack requires only basic authenticated access to the WordPress site—any user with Subscriber-level permissions or higher can exploit this vulnerability. Since WordPress allows user registration by default on many installations, this significantly lowers the barrier to exploitation.

Root Cause

The root cause is the absence of a capability check within the pm_deactivate_user_from_group() function located in the class-profile-magic-public.php file around line 3167. WordPress plugins should implement functions like current_user_can() to verify that the authenticated user has appropriate permissions before executing privileged operations. Without this authorization gate, any authenticated user can invoke the AJAX action and manipulate group memberships for arbitrary users.

Attack Vector

The attack is network-based and requires the attacker to have an authenticated session with at least Subscriber-level access. The exploitation flow involves:

1. Attacker registers or compromises a low-privilege account on the target WordPress site
2. Attacker crafts a malicious AJAX request to the pm_deactivate_user_from_group action
3. The request includes target user ID and group parameters
4. The vulnerable function processes the request without authorization verification
5. The target user (potentially an administrator) is suspended from the specified group

The vulnerability can be exploited through standard HTTP POST requests to the WordPress AJAX endpoint (/wp-admin/admin-ajax.php) with the action parameter set to pm_deactivate_user_from_group. Technical details regarding the vulnerable code path can be found in the WordPress Plugin File Reference.

Detection Methods for CVE-2025-13416

Indicators of Compromise

• Unexpected user suspension events in WordPress group management logs
• Anomalous AJAX requests to admin-ajax.php with action=pm_deactivate_user_from_group from low-privilege user sessions
• Reports from administrators or users about being unexpectedly removed from groups
• Increased activity from subscriber-level accounts targeting the ProfileGrid AJAX endpoints

Detection Strategies

• Monitor WordPress AJAX request logs for pm_deactivate_user_from_group actions originating from non-administrative users
• Implement Web Application Firewall (WAF) rules to flag suspicious patterns in requests to the ProfileGrid AJAX endpoints
• Review user activity logs for subscriber accounts making administrative-level operations
• Deploy endpoint detection to identify unusual POST request patterns to WordPress admin-ajax.php

Monitoring Recommendations

• Enable detailed logging for all AJAX actions within WordPress and review for unauthorized operation attempts
• Configure alerts for group membership changes that occur outside of administrative dashboard sessions
• Regularly audit user roles and permissions to identify compromised or suspicious accounts
• Implement rate limiting on AJAX endpoints to slow potential automated exploitation attempts

How to Mitigate CVE-2025-13416

Immediate Actions Required

• Update the ProfileGrid – User Profiles, Groups and Communities plugin to a version newer than 5.9.7.2 immediately
• Audit recent group membership changes to identify potential unauthorized suspensions
• Review and restore any users who may have been improperly suspended from groups
• Consider temporarily disabling user registration if the plugin cannot be immediately updated

Patch Information

The vulnerability has been addressed in versions after 5.9.7.2. The patch implements proper capability checks within the pm_deactivate_user_from_group() function to ensure only authorized users can perform group suspension actions. Details of the security fix can be reviewed in the WordPress Changeset Details. Additional vulnerability analysis is available from Wordfence Vulnerability Analysis.

Workarounds

• Restrict user registration on the WordPress site until the plugin is updated
• Implement a WAF rule to block requests to admin-ajax.php containing the pm_deactivate_user_from_group action from non-administrative users
• Temporarily deactivate the ProfileGrid plugin if group functionality is not critical to site operations
• Use a security plugin to enforce additional capability checks on AJAX requests

# Example .htaccess rule to temporarily block the vulnerable AJAX action
# Add to WordPress root .htaccess (temporary workaround only)
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteCond %{REQUEST_URI} ^/wp-admin/admin-ajax\.php$ [NC]
RewriteCond %{QUERY_STRING} action=pm_deactivate_user_from_group [NC,OR]
RewriteCond %{REQUEST_BODY} action=pm_deactivate_user_from_group [NC]
RewriteRule .* - [F,L]
</IfModule>