The ProfileGrid plugin for WordPress suffers from a missing capability check (CWE-862) in the pm_decline_join_group_request and pm_approve_join_group_request functions. This allows authenticated users with low privileges (Subscriber-level and above) to perform administrative actions related to group membership requests, which should be restricted to administrators only. The vulnerability is present in all versions up to 5.9.4.4. The CVSS 3.1 base score is 4.3, reflecting a medium severity with network attack vector, low attack complexity, and requiring privileges but no user interaction. No known exploits in the wild have been reported, and no patch or vendor advisory is currently available.

An attacker with Subscriber-level access or higher can approve or decline group join requests without proper authorization. This could lead to unauthorized changes in group memberships, potentially affecting group-based access controls or community management within the affected WordPress site. There is no direct confidentiality or availability impact reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict user roles carefully and monitor group membership changes. Avoid granting Subscriber-level or higher access to untrusted users. Follow updates from the metagauss vendor or WordPress plugin repository for official patches or temporary fixes.