ProfileGrid WordPress Plugin Missing Authorization Vulnerability Allows Arbitrary User Suspension

A vulnerability exists in the ProfileGrid – User Profiles, Groups and Communities plugin for WordPress, in versions through 5.9.7.2. The issue arises from a lack of proper capability checks in the pm_deactivate_user_from_group() function, allowing authenticated users with Subscriber-level access and above to suspend any user, including administrators, from groups. This is done through the pm_deactivate_user_from_group AJAX action.

Impact

Exploitation of this vulnerability allows for unauthorized suspension of users from groups, potentially disrupting their access or roles, especially if the suspended user is an administrator.

Remediation

Users can update to version 5.9.7.3 or a newer patched version to address this vulnerability.