HM Multiple Roles < 1.3 - Arbitrary Role Change

published 2021-08-23 5 y ago modified 2026-06-17 4 mo ago also EUVD-2021-11514

cvss: 8.8; version 3.1, NVD
cisa kev: Not listed; not in CISA's catalog
epss: 1.5%; EPSS 1.5% chance of exploitation in 30 days, percentile 74%
public exploits: 0; none known

The HM Multiple Roles WordPress plugin before 1.3 does not have any access control to prevent low privilege users to set themselves as admin via their profile page

Patch / fix

fixed in 1

hmplugin hm_multiple_roles 1.3

Exploit prediction

1.51% chance of exploitation in the next 30 days, higher than 74% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

jetpack.com https://jetpack.com/2021/08/05/privilege-escalation-in-hm-multiple-roles-wordpress-plugin/ referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by	version	score	vector
NVD	3.1	8.8	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
NVD	2.0	6.5	AV:N/AC:L/Au:S/C:P/I:P/A:P

Affected products

Unknown HM Multiple Roles

Classification

Weakness

CWE-269 Improper Privilege Management
CWE-669 Incorrect Resource Transfer Between Spheres

Technology feeds

WordPress rss critical rss

References

jetpack.com /2021/08/05/privilege-escalation-in-hm-multiple-roles-wordpress-plugin/
exploit, third-party-advisory
wpscan.com /vulnerability/5fd2548a-08de-4417-bff1-f174dab718d5
third-party-advisory

Sources

CVE List CVE-2021-24602
NVD CVE-2021-24602

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary