CVE-2021-24602: hmplugin hm_multiple_roles
CVSS: 8.8v3.1HighModified
Published 23-08-2021Last modified 03-08-2024
Vulnerability summary
CVE-2021-24602 is a high (CVSS 8.8) vulnerability in hmplugin hm_multiple_roles. EPSS estimates a 1.51% chance of exploitation in the next 30 days, higher than 74.1% of scored vulnerabilities. 1 public exploit is recorded.
CVSS score
8.8/10
010
High · v3.1 (NVD)EPSS score
1.51%
0%100%
Low · 0.00 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits1reference
Timeline
- 23-08-2021PublishedVulnerability first disclosed.
- 03-08-2024Last modifiedVulnerability information updated.
Description
The HM Multiple Roles WordPress plugin before 1.3 does not have any access control to prevent low privilege users to set themselves as admin via their profile page
CVSS metrics
3 scores · 2 sources · 2 versionsHigh 8.8Preferred score · NVD (NIST)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HSourcesAll 2 agree
- wordfenceSource8.8HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Medium 6.5Preferred score · NVD (NIST)
AV:N/AC:L/Au:S/C:P/I:P/A:PSourcesSingle source
EPSS trend
Probability
1.51%
Chance of exploitation in the next 30 days
Percentile
74%
Versus all other CVEs
30-day change
0.00 pp
From 1.51% on 21-09-2026
21-09-202621-10-2026
EPSS score1.51%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundExploit Reference (jetpack.com)
Maturity: unknown
Weaknesses
CWE · root cause- CWE-669Incorrect Resource Transfer Between SpheresThe product does not properly transfer a resource/behavior to another sphere, or improperly imports a resource/behavior from another sphere, in a manner that provides unintended control over that resource.
- CWE-269Improper Privilege ManagementThe product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.
Affected systems
Hmplugin1 product
- hm_multiple_roles< 1.3
Unknown1 product
- hm multiple roles≥ 1.3, < 1.3
Wordpress1 product
- hm-multiple-roles≤ 1.2 (fixed in 1.3)
3 vendors · 3 products
References
3 links- jetpack.com/2021/08/05/privilege-escalation-in-hm-multiple-roles-wordpress-plugin/X Refsource MISCExploitThird Party Advisory