CVE-2024-6411 is a privilege escalation vulnerability in the ProfileGrid – User Profiles, Groups and Communities WordPress plugin caused by improper privilege management (CWE-269). The issue stems from a lack of validation on user input in the 'pm_upload_image' AJAX action, enabling authenticated users with Subscriber or higher roles to modify their capabilities to Administrator. This vulnerability affects all versions up to and including 5.8.9 and has a CVSS 3.1 base score of 8.8, indicating a high impact on confidentiality, integrity, and availability.

An attacker with at least Subscriber-level access can exploit this vulnerability to escalate their privileges to Administrator. This grants full control over the WordPress site, potentially leading to complete compromise including data theft, site defacement, or further malicious activity. The vulnerability affects all versions of the plugin up to 5.8.9. There are no reports of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict Subscriber-level access where possible and monitor for suspicious privilege changes. Avoid installing or updating to vulnerable versions of the plugin. Follow vendor communications closely for updates on patches or official fixes.