CVE-2024-5453 describes a missing authorization vulnerability in the ProfileGrid – User Profiles, Groups and Communities WordPress plugin (versions up to 5.8.6). The vulnerability arises from the lack of capability checks in the pm_dismissible_notice and pm_wizard_update_group_icon functions, allowing authenticated users with Subscriber-level privileges or higher to arbitrarily set certain options to '1' or change group icons. This improper access control flaw enables unauthorized modification of plugin data, impacting data integrity but not confidentiality or availability. The CVSS 3.1 score of 4.3 reflects a network attack vector with low complexity and privileges required but no user interaction needed.

The vulnerability allows authenticated users with minimal privileges (Subscriber-level) to modify plugin options and group icons without authorization. This can lead to unauthorized changes in the plugin's configuration and appearance, potentially undermining trust or causing confusion among users. There is no impact on confidentiality or availability reported. No known exploitation in the wild has been documented.

No official patch or vendor advisory is currently available for this vulnerability. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is released, administrators should consider restricting Subscriber-level user capabilities or disabling the ProfileGrid plugin if unauthorized modifications pose a risk. Monitoring for plugin updates from metagauss is recommended to apply any forthcoming official fixes promptly.