CVE-2023-3713: ProfileGrid <= 5.5.1 - Authenticated (Subscriber+) Arbitrary Option Update
The ProfileGrid plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'profilemagicchecksmtpconnection' function in versions up to, and including, 5.5.1. This makes it possible for authenticated attackers, with subscriber-level permissions or above to update the site options arbitrarily. This can be used by attackers to achieve privilege escalation.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
wordpress/ProfileGridto a version that resolves this vulnerability.Fixed in 5.5.1 - Configuration
Update the ProfileGrid plugin to a fixed version and ensure 'profile_magic_check_smtp_connection' includes a capability check so that authenticated users with only subscriber-level permissions cannot arbitrarily update site options.
WordPress (ProfileGrid plugin) Capability check for 'profile_magic_check_smtp_connection' = Require appropriate capability before allowing updates
Event History
Frequently Asked Questions
What is the vulnerability ID of this vulnerability?
The vulnerability ID of this vulnerability is CVE-2023-3713.
What is the severity of CVE-2023-3713?
The severity of CVE-2023-3713 is high with a severity value of 8.8.
Which software versions are affected by CVE-2023-3713?
Versions up to and including 5.5.1 of the ProfileGrid plugin for WordPress are affected by CVE-2023-3713.
How can the vulnerability be exploited?
Authenticated attackers with subscriber-level permissions can exploit the vulnerability to perform unauthorized modification of data.
Are there any references available for CVE-2023-3713?
Yes, you can find references for CVE-2023-3713 at the following links: [Reference 1](https://plugins.trac.wordpress.org/browser/profilegrid-user-profiles-groups-and-communities/tags/5.4.8/admin/class-profile-magic-admin.php#L599), [Reference 2](https://www.wordfence.com/threat-intel/vulnerabilities/id/473ba791-af99-4aae-99cb-ccf220e443e7?source=cve), [Reference 3](https://plugins.trac.wordpress.org/changeset/2938904/profilegrid-user-profiles-groups-and-communities#file0).