CVE-2025-1408: ProfileGrid – User Profiles, Groups and Communities <= 5.9.4.4 - Missing Authorinzation to Authenticated (Subscriber+) Join Group Requests Management
The ProfileGrid – User Profiles, Groups and Communities plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the pmdeclinejoingrouprequest and pmapprovejoingrouprequest functions in all versions up to, and including, 5.9.4.4. This makes it possible for authenticated attackers, with Subscriber-level access and above, to approve or decline join group requests which is normally should be available to administrators only.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-1408?
CVE-2025-1408 is rated as a high severity vulnerability due to its potential for unauthorized data modification.
How do I fix CVE-2025-1408?
To fix CVE-2025-1408, you should update the ProfileGrid – User Profiles, Groups and Communities plugin to the latest version.
What are the affected versions for CVE-2025-1408?
CVE-2025-1408 affects all versions of the ProfileGrid plugin up to and including version 5.9.4.4.
Who is impacted by CVE-2025-1408?
Any website using the ProfileGrid – User Profiles, Groups and Communities plugin versions up to 5.9.4.4 is vulnerable to CVE-2025-1408.
What causes the vulnerability in CVE-2025-1408?
The vulnerability in CVE-2025-1408 is caused by a missing capability check on certain functions, allowing unauthorized users to modify data.