Multiple Roles
Multiple Roles has 2 disclosed vulnerabilities in the WordSec catalog, reported between 2021 and 2022; all 2 are fixed as of September 2026. Their average CVSS score is 6.6, and the most serious one scores 8.8 out of 10. Severity breakdown: 0 critical and 1 high.
The most common weakness is Cross-Site Request Forgery (CSRF), behind 1 of the records (50%). Other recurring categories include Improper Authorization.
Every one of the 2 issues recorded for Multiple Roles has a vendor fix available, so running the current release closes all known holes.
All of these findings were reported by Jerome Bruandet. Multiple Roles is installed on roughly 5,000 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.0.4.
Multiple Roles < 1.3.7 - Privilege Escalation
Read the full analysisVulnerability Records
Multiple Roles
Author
Christian Neumann
This plugin allows you to select multiple roles for a user – something that WordPress already supports “under the hood”, but doesn’t provide a user interface for. User edit and Add new user screens will display a checklist of roles instead of the default role dropdown. The main user list screen will also display all roles a user has. It also supports well Multisite mode. That’s it. No extra settings. If you want to contribute to this plugin, feel free to check the Github repository : https://github.com/chrneumann/multiple-roles
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C