CVE-2024-13835CWE-269

Post Meta Data Manager <= 1.4.4 - Authentciated (Admin+) Multisite Privilege Escalation

High · published March 8, 2025

CVSS v3.1
7.2
EPSS
0%
Percentile
33.4
In the wild
Unconfirmed
What it is

The Post Meta Data Manager plugin for WordPress is vulnerable to multisite privilege escalation in all versions up to, and including, 1.4.4. This is due to the plugin not properly verifying the existence of a multisite installation prior to allowing user meta to be added/modified. This makes it possible for authenticated attackers, with Administrator-level access and above, to gain elevated privileges on subsites that would otherwise be inaccessible.

The record
Technical detail
CVSS v3.1
7.2 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00403 · 33.4th percentile
Weakness
CWE-269 · Improper Privilege Management
Published
2025-03-08T02:24Z
EPSS history
Timeline
  • 08 MAR 02:24Z
    Post Meta Data Manager <= 1.4.4 - Authentciated (Admin+) Multisite Privilege Escalation
    cvelistv5