Automatic User Roles Switcher <= 1.1.1 - Missing Authorization to Privilege Escalation
2022-10-10 00:00
WPScanTeamStrategic Overview
StatusPatched in 1.1.2
Affected PluginAutomatic User Roles Switcher
Affected Version
<= 1.1.1CVSS8.1High
CVE
CVE-2022-3419Vulnerability Overview
The Automatic User Roles Switcher plugin for WordPress is vulnerable to authorization bypass due to missing authorization on an unknown function in versions up to, and including, 1.1.1. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to change their own role to administrator.
Technical Analysis
REMEDIATION: Update to version 1.1.2, or a newer patched version --- IDENTIFIER: CWE-269 (Improper Privilege Management) The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.
External References
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C