CVE-2023-3714

Summary

CVE-2023-3714 is a vulnerability affecting the ProfileGrid plugin for WordPress. This issue allows authenticated attackers, who possess group ownership, to manipulate group options unchecked. Specifically, the 'edit_group' handler is missing capability checks, enabling attackers to update group settings, including the 'associate_role' parameter. Although version 5.5.2 introduced a partial patch, preventing privilege escalation, the full vulnerability was rectified in version 5.5.3.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.