High · published November 18, 2025
⚡ A sneaky oversight lets authenticated attackers make unauthorized changes to user roles with the Multiple Roles per User plugin for WordPress! 🔥 Think of it like a hotel where the staff can change room assignments without proper oversight. An employee could bump a guest up to the penthouse suite or send the manager to a closet room, creating chaos and mistrust. This vulnerability allows attackers with 'edit_users' capability to modify user roles at will. They could promote themselves or others to Administrator, giving them full control over the site, or demote existing Administrators to lower privileges, potentially locking them out of their own accounts! Absolutely devastating!
Think of it like a hotel where the staff can change room assignments without proper oversight. An employee could bump a guest up to the penthouse suite or send the manager to a closet room, creating chaos and mistrust. The issue arises from missing capability checks on the 'mrpu_add_multiple_roles_ui' and 'mrpu_save_multiple_user_roles' functions, allowing any authenticated user with the right permissions to alter roles without restriction.
This vulnerability allows attackers with 'edit_users' capability to modify user roles at will. They could promote themselves or others to Administrator, giving them full control over the site, or demote existing Administrators to lower privileges, potentially locking them out of their own accounts! Absolutely devastating! Patch the Multiple Roles per User plugin to version 1.0.1 or later immediately. Additionally, review user permissions to ensure only trusted individuals have 'edit_users' capability. Regularly audit user roles to prevent unauthorized changes. You've got this! Follow these steps and your site will be secure in no time! 🛡️