CVE-2024-6411

CVE-2024-6411 is a privilege escalation vulnerability affecting all versions up to 5.8.9 of the ProfileGrid – User Profiles, Groups and Communities plugin for WordPress. The flaw stems from insufficient validation of user-supplied data within the 'pm_upload_image' AJAX action. This allows authenticated attackers with Subscriber-level access or higher to elevate their privileges to Administrator. The vulnerability carries a CVSS score of 8.8 (HIGH), indicating a severe risk. It is easily exploitable over the network with low attack complexity and no user interaction required, potentially leading to complete compromise of confidentiality, integrity, and availability. Currently, there is no evidence of active exploitation, nor are there publicly available exploit modules in Metasploit, Nuclei, or ExploitDB. The vulnerability has received minimal community discussion and no media coverage, suggesting low public awareness at this time.