CVEvulnerability

CVE-2021-24602

8.8 HIGH Published 2021-08-23 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2021-08-23
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
8.8 HIGH — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0 ([email protected])
6.5 MEDIUM — AV:N/AC:L/Au:S/C:P/I:P/A:P
Weaknesses
CWE-269, CWE-669

Description

The HM Multiple Roles WordPress plugin before 1.3 does not have any access control to prevent low privilege users to set themselves as admin via their profile page

Affected configurations

• hmplugin hm multiple roles (< 1.3)

Related

Weakness · CWE (2)

  • CWE-269 Improper Privilege Management weakness
  • CWE-669 Incorrect Resource Transfer Between Spheres weakness

References