TI-2021-06885 Aliases CVE-2021-24602 GHSA-q963-v9w4-pqp9

HM Multiple Roles < 1.3 - Arbitrary Role Change

MEDIUM 41CWE-269Published 2021-08-23 · Updated 2024-08-03

Key facts

Attack vector: Network
Privileges required: Low
User interaction: None
Attack complexity: Low
Impact type: Privilege escalation
Confidentiality · integrity · availability: High · High · High
Fix status: Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-269.

Summary

The HM Multiple Roles WordPress plugin before 1.3 does not have any access control to prevent low privilege users to set themselves as admin via their profile page

Why it matters now

EPSS 0.01509 74th percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by NVD

Fix Fixed HM Multiple Roles (Unknown): 1.3

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Unknown	HM Multiple Roles	1.3 to before 1.3	1.3	Patch available	CNA

HM Multiple Roles VendorUnknown Affected 1.3 to before 1.3 Fixed in 1.3 Patch available CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:hmplugin:hm_multiple_roles::::::wordpress::*	before 1.3	Vulnerable	HM Plugin

cpe:2.3:a:hmplugin:hm_multiple_roles:*:*:*:*:*:wordpress:*:* Versions before 1.3 Vulnerable ·HM Plugin

Remediation

Fix · CNA HM Multiple Roles (Unknown) Fixed in 1.3

Timeline

2026-10-02 Threatist record created from CVE-2021-24602
2026-10-03 Alias added: GHSA-q963-v9w4-pqp9

References

Exploit 1

https://jetpack.com/2021/08/05/privilege-escalation-in-hm-multiple-roles-wordpress-plugin/

Advisory 1

https://wpscan.com/vulnerability/5fd2548a-08de-4417-bff1-f174dab718d5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences