{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-11620", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-10-10T19:08:52.659Z", "datePublished": "2025-11-18T08:27:30.802Z", "dateUpdated": "2026-04-08T16:44:49.981Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:44:49.981Z"}, "affected": [{"vendor": "jemoreto", "product": "Multiple Roles per User", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "1.0", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Multiple Roles per User plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'mrpu_add_multiple_roles_ui' and 'mrpu_save_multiple_user_roles' functions in all versions up to, and including, 1.0. This makes it possible for authenticated attackers, granted the 'edit_users' capability, to edit any user's role, including promoting users to Administrator and demoting Administrators to lower-privileged roles."}], "title": "Multiple Roles per User <= 1.0 - Missing Authorization to Authenticated (Custom+) Privilege Escalation", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/30741601-50b9-4799-a340-11f6ffa59553?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/multiple-roles-per-user/trunk/multiple-roles-per-user.php#L54"}, {"url": "https://plugins.trac.wordpress.org/browser/multiple-roles-per-user/trunk/multiple-roles-per-user.php#L121"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-862 Missing Authorization", "cweId": "CWE-862", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.2, "baseSeverity": "HIGH"}}], "credits": [{"lang": "en", "type": "finder", "value": "Jonas Benjamin Friedli"}], "timeline": [{"time": "2025-11-17T20:12:39.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-11-18T16:14:28.486493Z", "id": "CVE-2025-11620", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-11-18T16:14:35.718Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-11620", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2025-11-18T16:14:28.486493Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-11-18T16:14:31.410Z"}}], "cna": {"title": "Multiple Roles per User <= 1.0 - Missing Authorization to Authenticated (Custom+) Privilege Escalation", "credits": [{"lang": "en", "type": "finder", "value": "Jonas Benjamin Friedli"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 7.2, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"}}], "affected": [{"vendor": "jemoreto", "product": "Multiple Roles per User", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "1.0"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-11-17T20:12:39.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/30741601-50b9-4799-a340-11f6ffa59553?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/multiple-roles-per-user/trunk/multiple-roles-per-user.php#L54"}, {"url": "https://plugins.trac.wordpress.org/browser/multiple-roles-per-user/trunk/multiple-roles-per-user.php#L121"}], "descriptions": [{"lang": "en", "value": "The Multiple Roles per User plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'mrpu_add_multiple_roles_ui' and 'mrpu_save_multiple_user_roles' functions in all versions up to, and including, 1.0. This makes it possible for authenticated attackers, granted the 'edit_users' capability, to edit any user's role, including promoting users to Administrator and demoting Administrators to lower-privileged roles."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-862", "description": "CWE-862 Missing Authorization"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:44:49.981Z"}}}, "cveMetadata": {"cveId": "CVE-2025-11620", "state": "PUBLISHED", "dateUpdated": "2026-04-08T16:44:49.981Z", "dateReserved": "2025-10-10T19:08:52.659Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-11-18T08:27:30.802Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"cveTags": [], "descriptions": [{"lang": "en", "value": "The Multiple Roles per User plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'mrpu_add_multiple_roles_ui' and 'mrpu_save_multiple_user_roles' functions in all versions up to, and including, 1.0. This makes it possible for authenticated attackers, granted the 'edit_users' capability, to edit any user's role, including promoting users to Administrator and demoting Administrators to lower-privileged roles."}], "id": "CVE-2025-11620", "lastModified": "2026-04-15T00:35:42.020", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.2, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.2, "impactScore": 5.9, "source": "security@wordfence.com", "type": "Secondary"}]}, "published": "2025-11-18T09:15:47.123", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/multiple-roles-per-user/trunk/multiple-roles-per-user.php#L121"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/multiple-roles-per-user/trunk/multiple-roles-per-user.php#L54"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/30741601-50b9-4799-a340-11f6ffa59553?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-862"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-22T21:10:50.380592+00:00", "value": {"mitigation_remediation": ["Apply the latest version of the Multiple Roles per User plugin that includes the missing authorization check", "If an upgrade cannot be performed immediately, disable the Multiple Roles per User plugin until a patched version is available", "Review and restrict the edit_users capability in the site, ensuring only trusted users retain that permission"], "summary": {"action": "Patch Now", "impact": "Privilege Escalation"}, "threat_synthesis": {"affected_systems": "The affected system is the WordPress Multiple Roles per User plugin, developed by jemoreto. All released versions up to and including 1.0 are affected.", "description_and_impact": "The Multiple Roles per User plugin for WordPress is vulnerable to unauthorized modification of data because all versions up to 1.0 lack a capability check on the functions that add and save user roles. An authenticated user who has the 'edit_users' capability can change any other user's role, promoting them to Administrator or demoting existing Administrators to lower\u2011privileged roles.", "risk_and_exploitability": "The CVSS score of 7.2 indicates a medium\u2011to\u2011high severity vulnerability that can be exploited by any authenticated user with edit_users rights. The EPSS score is below 1%, suggesting a very low probability of exploitation at present, though the issue is not listed in CISA's KEV catalog. A likely attack vector is a local authenticated attacker using a WordPress user account with edit_users capability to modify role assignments."}}}}, "created": "2025-11-18T14:15:59.184874+00:00", "updated": "2026-04-22T21:15:27.682599+00:00", "vendors": ["wordpress", "wordpress$PRODUCT$wordpress"]}