CVE-2024-3606: ProfileGrid – User Profiles, Memberships, Groups and Communities <= 5.8.3 - Missing Authorization
The ProfileGrid – User Profiles, Memberships, Groups and Communities plugin for WordPress is vulnerable to unauthorized deletion of data due to a missing capability check on the pmuploadcoverimage function in all versions up to, and including, 5.8.3. This makes it possible for authenticated attackers, with subscriber access or higher, to delete attachments.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-3606?
CVE-2024-3606 is rated as a high severity vulnerability due to the potential for unauthorized data deletion.
How do I fix CVE-2024-3606?
To fix CVE-2024-3606, update the ProfileGrid plugin to version 5.8.4 or later, which contains the necessary capability checks.
Who is affected by CVE-2024-3606?
All versions of the ProfileGrid plugin up to and including 5.8.3 are affected by CVE-2024-3606.
What systems are at risk from CVE-2024-3606?
Any WordPress installations using the ProfileGrid plugin prior to version 5.8.4 are at risk from CVE-2024-3606.
What actions can unauthorized users perform due to CVE-2024-3606?
Unauthorized users can potentially delete data associated with user profiles due to the lack of a capability check in the affected function.