CVE-2023-3403
MediumCVSS 5.4Exploitation Probability (EPSS)
Low risk37th percentile - higher than 37% of all known CVEs
Summary
The ProfileGrid plugin for WordPress is vulnerable to unauthorized data modification due to a missing capability check on the 'pm_upload_csv' function in versions up to and including 5.5.1. This allows authenticated attackers with subscriber-level permissions or higher to import new users and update existing users.
Risk Assessment
The organization may be exposed to unauthorized changes in user data, potentially leading to privacy breaches and security issues.
Recommendation
It is recommended to update the ProfileGrid plugin to the latest version to mitigate this vulnerability and conduct a user permissions audit.
Original NVD description (English source)
The ProfileGrid plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'pm_upload_csv' function in versions up to, and including, 5.5.1. This makes it possible for authenticated attackers, with subscriber-level permissions or above to import new users and update existing users.