CVE-2021-24602 HM Multiple Roles < 1.3 - Arbitrary Role Change
Low-privilege users can escalate to admin by modifying their profile in the HM Multiple Roles WordPress plugin.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2021-24602?
CVE-2021-24602 is a high-severity vulnerability in Unknown HM Multiple Roles, published on 23 Aug 2021. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
The HM Multiple Roles WordPress plugin before 1.3 does not have any access control to prevent low privilege users to set themselves as admin via their profile page
Which versions are affected by CVE-2021-24602?
It affects 1 product.
Products include Hmplugin Hm Multiple Roles.
How do I fix CVE-2021-24602?
No fix has been published for CVE-2021-24602 yet. Limit exposure of the affected software until one is available.
Is CVE-2021-24602 being exploited?
There is no known exploitation of CVE-2021-24602 in the wild and no public exploit code.
Sources
Also known as GHSA-q963-v9w4-pqp9.