Subscriber-to-Administrator escalation via unrestricted user metadata update

Privilege escalation in ProfileGrid 5.8.9 and earlier allows remote authenticated users to grant themselves Administrator access. The pm_upload_image AJAX handler loads crop.php, which passes attacker-controlled user_meta and array-valued attachment_id fields to update_user_meta without restricting the metadata key or value. Subscriber-level access and a profile-picture update request are sufficient to overwrite wp_capabilities, enabling full administrative control of the WordPress site.