GCVE - cpe:2.3:a:cneumann:multiple

Approved changes feed: RSS · Atom

cpe:2.3:a:cneumann:multiple_roles:*:*:*:*:*:*:*:*

part: a version: * update: *

Vendor	Cneumann (`70a55764-3a0f-519a-ad8e-dbfba763eadf`)
Product	Multiple Roles (`2cedefee-7715-5c89-9266-a0661868caa9`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*

Notes

Imported from gcve-enriched-dumps CVE data

PURL	Source	Last updated
No PURL mappings for this CPE yet.

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2021-4402`	vulnerable	2026-06-08 05:38:09.348958	Multiple Roles <= 1.3.1- Cross-Site Request Forgery Bypass MEDIUM (4.3) The Multiple Roles plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.3.1. This is due to missing or incorrect nonce validation on the mu_add_roles_in_signup_meta() and mu_add_roles_in_signup_meta_recently() functions. This makes it possible for unauthenticated attackers to add additional roles to users via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Published: 2023-07-01T05:33:28.246Z Updated: 2026-04-08T17:04:44.358Z Open on db.gcve.eu Reference links https://www.wordfence.com/threat-intel/vulnerabilities/id/862fa0c3-c16f-493e-9bf6-92debc0e30f6?source=cve https://blog.nintechnet.com/25-wordpress-plugins-vulnerable-to-csrf-attacks/ https://blog.nintechnet.com/more-wordpress-plugins-and-themes-vulnerable-to-csrf-attacks/ https://blog.nintechnet.com/multiple-wordpress-plugins-fixed-csrf-vulnerabilities-part-3/ https://blog.nintechnet.com/multiple-wordpress-plugins-fixed-csrf-vulnerabilities-part-2/	Imported from gcve-enriched-dumps CVE data

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.

Inspect record JSON

Open this panel to browse, search, copy or download the JSON record.