High severity · published Aug 23, 2021
CVE-2021-24602
The HM Multiple Roles WordPress plugin before 1.3 does not have any access control to prevent low privilege users to set themselves as admin via their profile page
8.8
CVSS
1.5%
EPSS
No
On KEV
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.5% · higher than 74% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
HM
HM Multiple Roles · Hmplugin
before 1.3 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2021-24602
CVE.org
https://www.cve.org/CVERecord?id=CVE-2021-24602
Exploit
https://jetpack.com/2021/08/05/privilege-escalation-in-hm-multiple-roles-wordpress-plugin/
Third Party Advisory
https://wpscan.com/vulnerability/5fd2548a-08de-4417-bff1-f174dab718d5