CVE-2023-0940: Metagauss Profilegrid

High severity, CVSS 8.8. EPSS: 0.8% chance of exploitation in the next 30 days.

The ProfileGrid WordPress plugin before 5.3.1 provides an AJAX endpoint for resetting a user password but does not implement proper authorization. This allows a user with low privileges, such as subscriber, to change the password of any account, including Administrator ones.

Affected products

• Metagauss Profilegrid: before 5.3.1 (fixed in 5.3.1)

Published 2023-03-20. Last modified 2026-06-17.