What’s Vulnerable › Vulnerabilities

CVE-2021-24602: HM Multiple Roles < 1.3 - Arbitrary Role Change

• Severity: high (CVSS 8.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.5% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2021-08-23 · updated 2026-06-17
• Weakness: CWE-269

Description

The HM Multiple Roles WordPress plugin before 1.3 does not have any access control to prevent low privilege users to set themselves as admin via their profile page

Affected products

• HM Multiple Roles: before 1.3 — fixed in 1.3

How to fix

Upgrade to a fixed version: HM Multiple Roles 1.3. Check the vendor advisory for mitigations.

References

• https://jetpack.com/2021/08/05/privilege-escalation-in-hm-multiple-roles-wordpress-plugin/
• https://wpscan.com/vulnerability/5fd2548a-08de-4417-bff1-f174dab718d5
• https://jetpack.com/2021/08/05/privilege-escalation-in-hm-multiple-roles-wordpress-plugin/
• https://wpscan.com/vulnerability/5fd2548a-08de-4417-bff1-f174dab718d5

Get alerted when CVE-2021-24602 or the next vulnerability affects your stack