ProfileGrid WordPress Plugin Missing Authorization Vulnerability in Join Group Request Management

A vulnerability exists in the ProfileGrid – User Profiles, Groups and Communities plugin for WordPress, in all versions through 5.9.4.4. The issue arises from a lack of proper capability checks in the pm_decline_join_group_request and pm_approve_join_group_request functions. This flaw allows authenticated attackers with Subscriber-level access and above to approve or decline join group requests, a privilege that should be reserved for administrators.

Impact

Exploitation of this vulnerability allows unauthorized users to manage group join requests, potentially disrupting group management and user interactions within the community.

Remediation

Users are advised to update the ProfileGrid – User Profiles, Groups and Communities plugin to version 5.9.4.5 or a newer patched version.