CVE-2025-0723: ProfileGrid – User Profiles, Groups and Communities <= 5.9.4.7 - Authenticated (Subscriber+) SQL Injection
First published: Sat Mar 22 2025(Updated: )
The ProfileGrid – User Profiles, Groups and Communities plugin for WordPress is vulnerable to blind and time-based SQL Injections via the rid and search parameters in all versions up to, and including, 5.9.4.7 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Credit: security@wordfence.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| ProfileGrid – User Profiles, Groups and Communities | <=5.9.4.7 | |
| Metagauss ProfileGrid | <5.9.4.8 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://www.wordfence.com/threat-intel/vulnerabilities/id/140fa6e8-4381-4df2-af62-44d40b116daf?source=cve
- https://plugins.trac.wordpress.org/browser/profilegrid-user-profiles-groups-and-communities/tags/5.9.4.2/includes/class-profile-magic-request.php#L2379
- https://plugins.trac.wordpress.org/browser/profilegrid-user-profiles-groups-and-communities/tags/5.9.4.2/includes/class-profile-magic-chat-system.php#L39
Frequently Asked Questions
What is the severity of CVE-2025-0723?
CVE-2025-0723 is rated as a critical severity vulnerability due to the potential for remote code execution through SQL injection.
How do I fix CVE-2025-0723?
To fix CVE-2025-0723, upgrade the ProfileGrid – User Profiles, Groups and Communities plugin to version 5.9.4.8 or later.
What versions are affected by CVE-2025-0723?
CVE-2025-0723 affects all versions of the ProfileGrid – User Profiles, Groups and Communities plugin up to and including version 5.9.4.7.
What are the attack vectors for CVE-2025-0723?
CVE-2025-0723 can be exploited through blind and time-based SQL injection using the rid and search parameters.
Is my website at risk if I have an outdated ProfileGrid plugin related to CVE-2025-0723?
Yes, having an outdated version of the ProfileGrid plugin exposes your website to the exploitation risks associated with CVE-2025-0723.
- agent/weakness
- agent/references
- agent/title
- agent/first-publish-date
- agent/type
- agent/description
- agent/guess-ai
- agent/software-canonical-lookup
- agent/severity
- agent/author
- agent/source
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/softwarecombine
- agent/tags
- agent/event
- collector/nvd-api
- source/NVD
- vendor/profilegrid
- canonical/profilegrid – user profiles, groups and communities
- vendor/metagauss
- canonical/metagauss profilegrid