CVE-2025-1408

Summary

CVE-2025-1408 is a vulnerability affecting the ProfileGrid plugin for WordPress. This issue allows authenticated attackers with Subscriber-level access or higher to unauthorizedly approve or decline join group requests, a functionality that is typically restricted to administrators. The root cause of this vulnerability lies in the missing capability checks on the pm_decline_join_group_request and pm_approve_join_group_requests functions in all versions up to, and including, 5.9.4.4. This weakness exposes WordPress sites utilizing the ProfileGrid plugin to potential data manipulation risks.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.