ProfileGrid WordPress Plugin Insecure Direct Object Reference Vulnerability Allowing Private Messages Disclosure

A vulnerability allowing Insecure Direct Object Reference (IDOR) has been identified in the ProfileGrid – User Profiles, Groups and Communities plugin for WordPress, affecting all versions through 5.9.4.2. The vulnerability arises in the pm_messenger_show_messages function, where insufficient validation on a user-controlled key allows authenticated attackers with Subscriber-level access and above to access and read private conversations of other users.

Impact

Exploitation of this vulnerability allows for unauthorized access to private messages between users, potentially leading to privacy violations and misuse of disclosed information.

Remediation

Users are advised to update the ProfileGrid – User Profiles, Groups and Communities plugin to version 5.9.4.3 or a newer patched version.