CVE-2024-6411

Name of the Vulnerable Software and Affected Versions The ProfileGrid – User Profiles, Groups and Communities plugin for WordPress versions up to, and including, 5.8.9

Description The issue is due to a lack of validation on user-supplied data in the 'pm upload image' AJAX action, allowing authenticated attackers with Subscriber-level access and above to update their user capabilities to Administrator.

Recommendations For versions up to, and including, 5.8.9, update to a version higher than 5.8.9 to resolve the issue. As a temporary workaround, consider disabling the 'pm upload image' AJAX action until a patch is available. Restrict access to the AJAX endpoint to minimize the risk of exploitation. Avoid using the 'pm upload image' action in the affected plugin until the issue is resolved.