title: ProfileGrid < 5.3.1 - Subscriber+ Arbitrary Password Reset
description: The ProfileGrid WordPress plugin before 5.3.1 provides an AJAX endpoint for resetting a user password but does not implement proper authorization. This allows a user with low privileges, such as subscriber, to change the password of any account, including Administrator ones.
problem types: CWE-863 Incorrect Authorization
affected:
{
vendor: Unknown
product: ProfileGrid
versions:
status: affected, versionType: custom, version: 0, lessThan: 5.3.1
defaultStatus: unaffected
collectionURL: https://wordpress.org/plugins
}