Multisite Privilege Escalation Vulnerability in Post Meta Data Manager Plugin for WordPress

CVE-2024-13835

Summary

The Post Meta Data Manager plugin for WordPress has a security flaw that allows authenticated users with Administrator-level access to exploit multisite privilege escalation. The vulnerability arises due to the plugin failing to properly verify if a multisite installation is being used, enabling unauthorized modifications to user meta on subsites. Attackers can leverage this weakness to gain elevated privileges, accessing content and features that should remain restricted. It is crucial for site administrators to ensure they are using the latest secure versions to mitigate this risk.

References