CVE-2020-35935 - The Advanced Access Manager plugin before 6.6.2 for WordPress allows privilege escalation on profile updates via the aam_user_roles POST parameter if Multiple Role support is enabled

Back Back to CVE browser

HIGH

The Advanced Access Manager plugin before 6.6.2 for WordPress allows privilege escalation on profile updates via the aam_user_roles POST parameter if Multiple Role support is enabled

Published Jan 1, 2021

8.8

HIGH

CVSS 3.1

EPSS 1.48%

Description

The Advanced Access Manager plugin before 6.6.2 for WordPress allows privilege escalation on profile updates via the aam_user_roles POST parameter if Multiple Role support is enabled. (The mechanism for deciding whether a user was entitled to add a role did not work in various custom-role scenarios.)

Affected products

Remediation

No remediation recorded yet.

Weaknesses (0)

No CWE recorded.

References (1)

https://www.wordfence.com/blog/2020/08/high-severity-vulnerability-patched-in-advanced-access-manager/
x_refsource_MISCExploitThird Party Advisory

Link	Providers	Tags
https://www.wordfence.com/blog/2020/08/high-severity-vulnerability-patched-in-advanced-access-manager/		x_refsource_MISCExploitThird Party Advisory

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner mitre

Published Jan 1, 2021

Updated Aug 4, 2024

Reserved Jan 1, 2021

Link CVE-2020-35935

CISA Vulnrichment

Updated n/a

NVD

Status Modified

Modified Jun 17, 2026

Link CVE-2020-35935

Red Hat

Severity n/a

Public date n/a

Links CVE-2020-35935