ProfileGrid WordPress Plugin Missing Authorization Vulnerability Allows Arbitrary Group Joining

A vulnerability exists in the ProfileGrid – User Profiles, Groups and Communities plugin for WordPress, in all versions through 5.9.8.4. The issue arises from a missing capability check in the 'pm_invite_user' function, which allows authenticated users with Subscriber-level access and above to add themselves or any registered user to any ProfileGrid group. This includes closed and paid groups, bypassing all authorization and payment requirements.

Impact

Exploitation of this vulnerability allows for unauthorized group membership changes, including access to closed and paid groups, which could be misused for unauthorized activities or benefits within those groups.

Reproduction

To reproduce this vulnerability, an authenticated user with Subscriber-level access or higher can use the 'pm_invite_user' function without the necessary capability checks. This can be done by sending a request that includes the 'gid' parameter with the ID of the group to which the user wants to be added. The request can be made through the WordPress admin interface or via a custom script that interacts with the WordPress REST API.

Remediation

Users are advised to update the ProfileGrid – User Profiles, Groups and Communities plugin to version 5.9.8.5 or later.