CVE-2024-50504 HIGH

CVE-2024-50504: WordPress Bulk Change Role plugin <= 1.1 - Privilege Escalation vulnerability

Vendor Webxmedia
Product Bulk Change Role
Weakness CWE-266
Published October 30, 2024
Last update May 11, 2026
View on NVD All CVEs

CVSS base score

8.8/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality High
Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

What the vulnerability does

01Description

Incorrect Privilege Assignment vulnerability in webxmedia Bulk Change Role bulk-role-change allows Privilege Escalation.This issue affects Bulk Change Role: from n/a through <= 1.1.

Explanation of Vulnerability in Simple Terms

02Summary

Bulk Change Role for WordPress contains an authorization flaw that allows authenticated users with low privileges to perform administrative actions they should not have access to. The vulnerability affects all versions up to 1.1. An attacker with a standard user account can read sensitive data, modify site content, or disrupt service availability. Update to a version newer than 1.1 immediately.

What an attacker can do

03Attacker Capabilities

Read sensitive data, modify content, or disrupt the site using a low-privilege user account.

Potential impact on your site

04Site Impact

Any registered user can perform admin-level actions like changing roles, accessing private data, or modifying site settings.

Conditions required to exploit

05Prerequisites

Attacker needs a valid WordPress user account with low privileges; no user interaction required.

Key dates

06Disclosure timeline

October 30, 2024 CVE published
May 11, 2026 Record updated