Critical severity9.8NVD Advisory· Published Nov 13, 2024· Updated Jun 17, 2026
CVE-2024-11028
CVE-2024-11028
Description
The MultiManager WP – Manage All Your WordPress Sites Easily plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 1.0.5. This is due to the user impersonation feature inappropriately determining the current user via user-supplied input. This makes it possible for unauthenticated attackers to generate an impersonation link that will allow them to log in as any existing user, such as an administrator. NOTE: The user impersonation feature was disabled in version 1.1.0 and re-enabled with a patch in version 1.1.2.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
3<=1.0.5+ 1 more
- (no CPE)range: <=1.0.5
- (no CPE)
- icdsoft/MultiManager WP – Manage All Your WordPress Sites Easilyv5Range: 0
Patches
Vulnerability mechanics
References
4- www.wordfence.com/threat-intel/vulnerabilities/id/de8e7adc-3777-4fb1-a708-68da950e3d4fnvdThird Party Advisory
- plugins.trac.wordpress.org/changeset/3184657/multimanager-wpnvdProduct
- plugins.trac.wordpress.org/changeset/3184678/multimanager-wpnvdProduct
- plugins.trac.wordpress.org/changeset/3184826/multimanager-wpnvdProduct
News mentions
0No linked articles in our index yet.