CVE-2025-1408 Overview
CVE-2025-1408 affects the ProfileGrid – User Profiles, Groups and Communities plugin for WordPress. The vulnerability is a missing authorization flaw [CWE-862] in the pm_decline_join_group_request and pm_approve_join_group_request functions. All versions up to and including 5.9.4.4 are affected. Authenticated attackers with Subscriber-level access can approve or decline group join requests that should only be processable by administrators. The flaw impacts data integrity without exposing sensitive information or disrupting site availability.
Critical Impact
Any authenticated user, including low-privileged Subscribers, can manipulate group membership decisions in ProfileGrid, undermining community moderation controls.
Affected Products
- Metagauss ProfileGrid – User Profiles, Groups and Communities plugin for WordPress
- All versions up to and including 5.9.4.4
- WordPress sites using ProfileGrid community and group features
Discovery Timeline
- 2025-03-22 - CVE-2025-1408 published to the National Vulnerability Database (NVD)
- 2026-06-17 - Last updated in the NVD database
Technical Details for CVE-2025-1408
Vulnerability Analysis
The ProfileGrid plugin exposes two AJAX-accessible handlers that manage group membership decisions: pm_approve_join_group_request and pm_decline_join_group_request. Both functions execute privileged state changes on group join requests but omit a WordPress capability check such as current_user_can(). As a result, any authenticated session, including Subscriber accounts created through open registration, can invoke these handlers.
An attacker exploiting this flaw can approve users into groups they should not be members of or decline pending requests to disrupt legitimate onboarding. The impact is limited to integrity of group membership data. Confidentiality and availability are not directly affected.
The underlying weakness is a classic Missing Authorization pattern [CWE-862], where authentication is verified but the caller's role or capability is never validated before performing a sensitive operation.
Root Cause
The root cause lies in the handler implementations referenced at lines 3262 and 3306 of public/class-profile-magic-public.php. These functions accept a request identifier from the client and mutate group membership state without confirming that the caller holds an administrative capability. WordPress registers the endpoints for all logged-in users through the wp_ajax_ action hook, which grants access to every authenticated role by default unless the handler enforces its own check.
Attack Vector
Exploitation requires only Subscriber-level credentials, which are trivially obtained on sites with open user registration. The attacker sends an authenticated HTTP POST request to the WordPress admin-ajax.php endpoint, specifying the vulnerable action name and a target join request identifier. The server processes the request and modifies group membership as if the caller were an administrator. No user interaction is required beyond the attacker's own authenticated session.
For code-level context, review the ProfileGrid Code Reference Line 3262 and ProfileGrid Code Reference Line 3306.
Detection Methods for CVE-2025-1408
Indicators of Compromise
- Requests to /wp-admin/admin-ajax.php with action=pm_approve_join_group_request or action=pm_decline_join_group_request originating from Subscriber-level sessions.
- Unexpected changes to ProfileGrid group membership records without corresponding administrator activity in the WordPress audit log.
- Newly registered low-privilege accounts issuing AJAX calls to ProfileGrid endpoints shortly after account creation.
Detection Strategies
- Correlate WordPress access logs with the authenticated user role, flagging invocations of the two vulnerable actions by non-administrator roles.
- Deploy a Web Application Firewall (WAF) rule that inspects admin-ajax.php POST bodies for the affected action names and blocks requests from users lacking manage_options.
- Baseline normal group approval activity and alert on volume anomalies or approvals occurring outside administrative working hours.
Monitoring Recommendations
- Enable a WordPress audit-logging plugin to capture group membership changes with the acting user identity.
- Ship WordPress and web server logs to a centralized SIEM or data lake for retention and correlation across sessions.
- Review the Wordfence Vulnerability Analysis for signature updates and observed exploitation patterns.
How to Mitigate CVE-2025-1408
Immediate Actions Required
- Update the ProfileGrid plugin to a version later than 5.9.4.4 as soon as the vendor publishes a fixed release.
- Audit ProfileGrid group membership tables for unauthorized approvals since the plugin was installed.
- Restrict new user registration or set the default role to a custom, minimally privileged role while patching is pending.
Patch Information
All versions of ProfileGrid up to and including 5.9.4.4 are vulnerable. Site operators should monitor the plugin listing on WordPress.org and apply the vendor's security update once available. Confirm the installed version through the WordPress plugins page after updating.
Workarounds
- Temporarily deactivate the ProfileGrid plugin on sites where group moderation integrity is critical.
- Add a WAF rule that blocks unauthenticated and Subscriber-level requests targeting pm_approve_join_group_request and pm_decline_join_group_request.
- Disable open user registration under Settings > General to reduce the pool of accounts that can reach the vulnerable handlers.
# Configuration example: disable open registration and reset default role via WP-CLI
wp option update users_can_register 0
wp option update default_role subscriber
wp plugin deactivate profilegrid-user-profiles-groups-and-communities
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
