CVE-2024-3606: 
WordPress vulnerability analysis and mitigation

The ProfileGrid – User Profiles, Memberships, Groups and Communities WordPress plugin contains a vulnerability (CVE-2024-3606) that affects all versions up to and including 5.8.3. The vulnerability was discovered and disclosed on April 16, 2024, with public disclosure on May 2, 2024 (NVD, Wordfence).

The vulnerability stems from a missing capability check in the pm_upload_cover_image function, which allows unauthorized deletion of data. The issue has been assigned a CVSS v3.1 base score of 4.3 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N. The vulnerability is classified as CWE-862: Missing Authorization (NVD).

This vulnerability allows authenticated attackers with subscriber-level access or higher to delete attachments from the WordPress installation. This unauthorized deletion capability could lead to loss of data and potential disruption of website functionality (NVD).

The vulnerability requires an authenticated user with at least subscriber-level access to exploit. The attack complexity is considered low, requiring no user interaction to execute (NVD).

Users are advised to update to version 5.8.4 or later which contains the fix for this vulnerability. The patch has been implemented and is available through the WordPress plugin repository (WordPress Plugin).