HIGH🇵🇱 Wersja polska

CVE-2021-24602

CVSS 8.8v3.1pub. 2021-08-23upd. 2024-11-21

The HM Multiple Roles WordPress plugin before 1.3 does not have any access control to prevent low privilege users to set themselves as admin via their profile page

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

  • Hmplugin Hm Multiple Roles

    APP
    Hmplugin
    < 1.3
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
CWE
References

Related vulnerabilities

CVE-2023-29384CRITICAL10.0PL ✓same vendor

Nieograniczony upload plików w WordPress Plugin JobWP — RCE

CVE-2023-48288HIGH7.5same vendor

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in HM Plugin WordPress Job Board and ...

CVE-2024-50459MEDIUM5.3same vendor

Missing Authorization vulnerability in Hossni Mubarak AidWP wp-stripe-donation allows Exploiting Incorrectly C...

CVE-2023-23705MEDIUM4.3same vendor

Cross-Site Request Forgery (CSRF) vulnerability in HM Plugin WordPress Books Gallery plugin <= 4.4.8 versions.

CVE-2022-47422MEDIUM4.3same vendor

Cross-Site Request Forgery (CSRF) vulnerability in HM Plugin Accept Stripe Donation – AidWP plugin <= 3.1.5 ve...