Lucene search
WpvulndbWPEX-ID:5FD2548A-08DE-4417-BFF1-F174DAB718D5HistoryJul 20, 2021 - 12:00 a.m.
HM Multiple Roles < 1.3 - Arbitrary Role Change
2021-07-2000:00:00
wpvulndb
421
0.001 Low
EPSS
Percentile
36.7%
The plugin does not have any access control to prevent low privilege users to set themselves as admin via their profile page
As any authenticated user, go to your Profile page and Tick the Administrator Role checkbox. In v1.2, the checkboxes are disabled in the UI but can be tampered with by either using the web browser developer tool or a proxy such as Burp SuiteRelated
prion
prion
Code injection
2021-08-23 12:15:00
patchstack
patchstack
wpvulndb
wpvulndb
HM Multiple Roles < 1.3 - Arbitrary Role Change
2021-07-20 00:00:00
cve
cve
CVE-2021-24602
2021-08-23 12:15:10
cvelist
cvelist
CVE-2021-24602 HM Multiple Roles < 1.3 - Arbitrary Role Change
2021-08-23 11:10:19
nvd
nvd
CVE-2021-24602
2021-08-23 12:15:10