Read the docs

HM Plugin

Records6All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical2CVSS 9.0–10.0
CVSS high4CVSS 7.0–8.9

Exploited now

HM Plugin records in CISA KEV

No HM Plugin vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records
Jobwp 2 records MEDIUM Accept Stripe Donation - Aidwp 1 record LOW Aidwp 1 record MEDIUM Hm Multiple Roles 1 record MEDIUM Wordpress Books Gallery 1 record LOW

Records

1 record in Hm Multiple Roles · all components

TI-2021-06885 CVE-2021-24602 · GHSA-q963-v9w4-pqp9

HM Multiple Roles < 1.3 - Arbitrary Role Change

Priority MEDIUM 41

The HM Multiple Roles WordPress plugin before 1.3 does not have any access control to prevent low privilege users to set themselves as admin via their profile page

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.01509 Published 2021-08-23 Fixed in 1.3 CWE-269
Open these records in search →