Access violation vulnerability in ProfileGrid – User Profiles, Groups and Communities 5.9.3.6

A WordPress plugin called ProfileGrid, which allows users to create profiles, groups, and communities, has a security vulnerability. This means that unauthorized people may be able to change data without permission. The problem is caused by a missing capability check on a function called pm_remove_file_attachment(). This issue affects all versions of the plugin up to 5.9.3.6. This could allow attackers who are logged in with subscriber-level access or higher to delete important user information, which could potentially prevent an administrator from accessing their own website.