CVE-2020-35935

The Advanced Access Manager plugin before 6.6.2 for WordPress allows privilege escalation on profile updates via the aam_user_roles POST parameter if Multiple…

High · published January 1, 2021

CVSS v3.1
7.5
EPSS
1%
Percentile
73.7
In the wild
Unconfirmed
What it is

The Advanced Access Manager plugin before 6.6.2 for WordPress allows privilege escalation on profile updates via the aam_user_roles POST parameter if Multiple Role support is enabled. (The mechanism for deciding whether a user was entitled to add a role did not work in various custom-role scenarios.)

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AC:H/AV:N/A:H/C:H/I:H/PR:L/S:U/UI:N
CVSS v4.0
Not supplied
EPSS
0.01481 · 73.7th percentile
Published
2021-01-01T01:25Z
EPSS history
Timeline
  • 01 JAN 01:25Z
    The Advanced Access Manager plugin before 6.6.2 for WordPress allows privilege escalation on profile updates via the aam_user_roles POST parameter if Multiple…
    cvelistv5