What the vulnerability does
01Description
The MultiManager WP – Manage All Your WordPress Sites Easily plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 1.0.5. This is due to the user impersonation feature inappropriately determining the current user via user-supplied input. This makes it possible for unauthenticated attackers to generate an impersonation link that will allow them to log in as any existing user, such as an administrator. NOTE: The user impersonation feature was disabled in version 1.1.0 and re-enabled with a patch in version 1.1.2.
Explanation of Vulnerability in Simple Terms
02Summary
The MultiManager WP plugin for WordPress contains an authentication bypass vulnerability affecting versions up to 1.0.5. An attacker can gain unauthorized access to the plugin's functionality without valid credentials. The vulnerability stems from improper authentication checks (CWE-288) and allows complete compromise of confidentiality, integrity, and availability. Site administrators should update immediately to a version newer than 1.0.5.
What an attacker can do
03Attacker Capabilities
Gain unauthorized access to the plugin and compromise the WordPress site without valid credentials.
Potential impact on your site
04Site Impact
An attacker can read sensitive data, modify site content, disable the site, or take full control of WordPress.
Conditions required to exploit
05Prerequisites
Network access only; no authentication, user interaction, or special configuration required.
Key dates
06Disclosure timeline
November 13, 2024
CVE published
April 8, 2026
Record updated
