CVE-2023-3404 ProfileGrid <= 5.5.0 - Hardcoded Encryption Key

What is CVE-2023-3404?

CVE-2023-3404 is a medium-severity vulnerability in metagauss ProfileGrid – User Profiles, Groups and Communities, published on 31 Aug 2023. An attacker needs administrator access to exploit it, with no action from the victim.

Official description

The ProfileGrid plugin for WordPress is vulnerable to unauthorized decryption of private information in versions up to, and including, 5.5.0. This is due to the passphrase and iv being hardcoded in the 'pm_encrypt_decrypt_pass' function and used across all sites running the plugin. This makes it possible for authenticated attackers, with administrator-level permissions or above to decrypt and view users' passwords. If combined with another vulnerability, this can potentially grant lower-privileged users access to users' passwords.

Weakness: CWE-321

Which versions are affected by CVE-2023-3404?

It affects 1 product.

Products include Metagauss Profilegrid.

How do I fix CVE-2023-3404?

No fix has been published for CVE-2023-3404 yet. Limit exposure of the affected software until one is available.

Is CVE-2023-3404 being exploited?

There is no known exploitation of CVE-2023-3404 in the wild and no public exploit code.

Other vulnerabilities in metagauss ProfileGrid – User Profiles, Groups and Communities

• CVE-2024-30490 WordPress ProfileGrid plugin <= 5.7.8 - SQL Injection vulnerability Critical 9.3
• CVE-2025-0724 ProfileGrid – User Profiles, Groups and Communities <= 5.9.4.5 - Authenticated (Subscriber+) PHP Object Injection High 8.8
• CVE-2024-6411 Privilege escalation in ProfileGrid – User Profiles, Groups and Communities High 8.8
• CVE-2023-3713 ProfileGrid <= 5.5.1 - Authenticated (Subscriber+) Arbitrary Option Update High 8.8
• CVE-2023-0940 ProfileGrid < 5.3.1 - Subscriber+ Arbitrary Password Reset High 8.8

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-r386-5hxv-47fg.