CVE-2024-13740: ProfileGrid – User Profiles, Groups and Communities <= 5.9.4.2 - Insecure Direct Object Reference to Authenticated (Subscriber+) Private Messages Disclosure
The ProfileGrid – User Profiles, Groups and Communities plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.9.4.2 via the pmmessengershowmessages function due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with Subscriber-level access and above, to read private conversations of other users.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-13740?
CVE-2024-13740 has been classified as a medium severity vulnerability.
How do I fix CVE-2024-13740?
To fix CVE-2024-13740, update the ProfileGrid – User Profiles, Groups and Communities plugin to version 5.9.4.3 or later.
Who is affected by CVE-2024-13740?
CVE-2024-13740 affects all versions of the ProfileGrid – User Profiles, Groups and Communities plugin up to and including version 5.9.4.2.
What type of vulnerability is CVE-2024-13740?
CVE-2024-13740 is categorized as an Insecure Direct Object Reference (IDOR) vulnerability.
What is the impact of CVE-2024-13740?
The impact of CVE-2024-13740 includes unauthorized access to user messages due to insufficient validation of user input.