PT-2025-47251 · WordPress · Multiple Roles Per User

Published 2025-11-18 · Updated 2025-11-23 · CVE-2025-11620

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Multiple Roles per User plugin for WordPress versions up to and including 1.0

Description The Multiple Roles per User plugin for WordPress has a flaw that allows unauthorized data modification. This is due to a missing capability check within the mrpu add multiple roles ui and mrpu save multiple user roles functions. Authenticated attackers with the 'edit users' capability can modify any user's role, potentially granting themselves administrator privileges or demoting existing administrators.

Recommendations Update the Multiple Roles per User plugin to a version beyond 1.0.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2025-11620

Affected Products

Multiple Roles Per User

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2025-11620 · Security Note
• https://twitter.com/CVEnew/status/1990703902208278853 · Twitter Post
• https://plugins.trac.wordpress.org/browser/multiple-roles-per-user/trunk/multiple-roles-per-user.php#L54 · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/30741601-50b9-4799-a340-11f6ffa59553?source=cve · Note
• https://plugins.trac.wordpress.org/browser/multiple-roles-per-user/trunk/multiple-roles-per-user.php#L121 · Note
• https://twitter.com/cracbot/status/1992548741107339337 · Twitter Post
• https://t.me/cveNotify/143165 · Telegram Post