What is CVE-2024-11028?

CVE-2024-11028 is a critical-severity vulnerability in Icdsoft Multimanager Wp, classified under Authentication Bypass Using an Alternate Path or Channel. CVSS score: 9.8/10. Published 2024-11-13.

How severe is CVE-2024-11028?

Critical severity. CVSS v3 base score is 9.8 out of 10.

Vulnerability in Icdsoft Multimanager Wp

CVE-2024-11028

The MultiManager WP – Manage All Your WordPress Sites Easily plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 1.0.5. This is due to the user impersonation feature inappropriately determining the current user via user-supplied input. This makes it possible for unauthenticated attackers to generate an impersonation link that will allow them to log in as any existing user, such as an administrator. NOTE: The user impersonation feature was disabled in version 1.1.0 and re-enabled with a patch in version 1.1.2.

EPSS: 0.013 (66.4th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 9.8 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.

Affected products

Icdsoft Multimanager_wp
Icdsoft Multimanager Wp – Manage All Your Wordpress Sites Easily — versions 0

Weakness classification (CWE)

CWE-288 — Authentication Bypass Using an Alternate Path or Channel

References

security@wordfence.com (Third Party Advisory)
security@wordfence.com (Product)
security@wordfence.com (Product)
security@wordfence.com (Product)

Frequently asked questions

What is CVE-2024-11028?: CVE-2024-11028 is a critical-severity vulnerability in Icdsoft Multimanager Wp, classified under Authentication Bypass Using an Alternate Path or Channel. CVSS score: 9.8/10. Published 2024-11-13.
How severe is CVE-2024-11028?: Critical severity. CVSS v3 base score is 9.8 out of 10.