CVE-2024-13740 is an authorization bypass vulnerability in the ProfileGrid – User Profiles, Groups and Communities WordPress plugin, affecting all versions up to and including 5.9.4.2. The issue arises from the pm_messenger_show_messages function failing to validate a user-controlled key, enabling authenticated attackers with at least Subscriber privileges to access private messages of other users. This represents an Insecure Direct Object Reference (CWE-639) vulnerability allowing unauthorized data disclosure. The CVSS score of 4.3 reflects a medium severity impact with network attack vector, low attack complexity, and no user interaction required.

Authenticated users with Subscriber-level access or higher can read private conversations of other users, leading to unauthorized disclosure of sensitive information. There is no indication of impact on data integrity or availability. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, consider restricting Subscriber-level access or disabling the affected plugin functionality if possible to reduce risk.