ProfileGrid <= 6.0.0.2 - Authenticated (Subscriber+) Missing Authorization to Forced Friendship via Friend Request Acceptance
- ID
- WPSEC-2026-0058
- Plugin
- ProfileGrid – User Profiles, Groups and Communities (profilegrid-user-profiles-groups-and-communities)
- Affected
- all versions before 6.0.0.3
- Remediation
- Update to 6.0.0.3 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
- Weakness
- CWE-863
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-10-22
- Attack surface
- ProfileGrid on WPSec AttackSurface
- Fix released
- Published
Description
The User Profiles, Groups and Communities plugin for WordPress is vulnerable to unauthorized modification of data due to an insufficient authorization check in the pm_confirm_friend_request AJAX function in all versions up to, and including, 6.0.0.2. The function looked up any friendship row between the two users in either direction, regardless of its status, without verifying that the current user was the recipient of a pending request. This makes it possible for authenticated attackers with subscriber-level access to accept their own outgoing friend requests, including ones the recipient had already rejected, and force a friendship with another user, potentially gaining access to that user's friends-only content.
References
- https://wpsec.com/vuln/WPSEC-2026-0058/
- https://plugins.svn.wordpress.org/profilegrid-user-profiles-groups-and-communities/tags/6.0.0.3/
- https://wordpress.org/plugins/profilegrid-user-profiles-groups-and-communities/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS