Subscriber-to-Administrator takeover via unchecked password reset

Incorrect authorization in ProfileGrid before 5.3.1 allows remote authenticated users to reset any account password through an AJAX endpoint. The pm_reset_user_password action accepts an attacker-chosen user_id and new password after checking a nonce but not the caller's authority over the target account. Subscriber access is sufficient to replace an Administrator password, enabling account takeover and locking the administrator out.