CVE-2024-6410 ProfileGrid <= 5.8.9 - Authenticated (Subscriber+) Insecure Direct Object Reference

What is CVE-2024-6410?

CVE-2024-6410 is a medium-severity missing authorization vulnerability in metagauss ProfileGrid – User Profiles, Groups and Communities, published on 10 Jul 2024. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

The ProfileGrid – User Profiles, Groups and Communities plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.8.9 via the 'pm_upload_image' function due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with Subscriber-level access and above, to change the profile picture of any user.

Weakness: CWE-639

Which versions are affected by CVE-2024-6410?

It affects 1 product.

Products include Metagauss Profilegrid.

How do I fix CVE-2024-6410?

No fix has been published for CVE-2024-6410 yet. Limit exposure of the affected software until one is available.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2024-6410 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-6410 exists.

Other vulnerabilities in metagauss ProfileGrid – User Profiles, Groups and Communities

• CVE-2024-30490 WordPress ProfileGrid plugin <= 5.7.8 - SQL Injection vulnerability Critical 9.3
• CVE-2025-0724 ProfileGrid – User Profiles, Groups and Communities <= 5.9.4.5 - Authenticated (Subscriber+) PHP Object Injection High 8.8
• CVE-2024-6411 Privilege escalation in ProfileGrid – User Profiles, Groups and Communities High 8.8
• CVE-2023-3713 ProfileGrid <= 5.5.1 - Authenticated (Subscriber+) Arbitrary Option Update High 8.8
• CVE-2023-0940 ProfileGrid < 5.3.1 - Subscriber+ Arbitrary Password Reset High 8.8

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-mg8q-6jqj-3r4r.