CVE-2024-30490criticalCWE-89

CVE-2024-30490: critical vulnerability in Metagauss ProfileGrid

WordPress ProfileGrid plugin <= 5.7.8 - SQL Injection vulnerability

Published · Updated

Follow this CVE+ Monitor ProfileGrid

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

43Vexday Risk Score

Patch soon. It has a working public exploit.

ssvc Attendcvss 9.3epss 2.2%
In short

The WordPress ProfileGrid plugin version 5.7.8 and earlier contains a SQL injection flaw that allows attackers to manipulate database queries, potentially exposing or modifying sensitive user data without proper authorization.

Technical detail

A SQL injection vulnerability in ProfileGrid <= 5.7.8 allows attackers to inject malicious SQL commands through insufficiently sanitized user input, potentially leading to unauthorized database access, data exfiltration, or modification. The vulnerability stems from improper neutralization of special SQL characters in user-supplied parameters.

Summary generated and translated by AI from the official description.
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Metagauss ProfileGrid.This issue affects ProfileGrid : from n/a through 5.7.8.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L
Affected products
Metagauss · ProfileGrid
Related CVEs — Metagauss ProfileGrid

In the same product, most dangerous first.

CVE-2024-30491HIGHWordPress ProfileGrid – User Profiles, Memberships, Groups and Communities plugin <= 5.7.8 - SQL Injection vulnerabilityEPSS 32.0%CVE-2024-30241HIGHWordPress ProfileGrid – User Profiles, Memberships, Groups and Communities plugin <= 5.7.1 - Contributor+ SQL Injection vulnerabilityEPSS 0.9%CVE-2025-26999HIGHWordPress ProfileGrid Plugin <= 5.9.4.3 - PHP Object Injection vulnerabilityEPSS 0.7%CVE-2026-57697HIGHWordPress ProfileGrid plugin <= 5.9.9.6 - Broken Authentication vulnerabilityEPSS 0.5%CVE-2024-32774MEDIUMWordPress ProfileGrid plugin <= 5.8.2 - Group Members Limit Bypass vulnerabilityEPSS 0.5%CVE-2024-30513MEDIUMWordPress ProfileGrid plugin <= 5.7.2 - Insecure Direct Object References (IDOR) vulnerabilityEPSS 0.5%